@jabezpauls/agentbox 0.1.8 → 0.1.10

package/dist/agentbox.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// agentbox-cli v0.1.8
+// agentbox-cli v0.1.10
 import { createRequire as __agentboxCreateRequire } from "node:module";
 const require = __agentboxCreateRequire(import.meta.url);
 var __create = Object.create;
@@ -1397,7 +1397,7 @@ var require_receiver = __commonJS({
 var require_sender = __commonJS({
   "../node_modules/ws/lib/sender.js"(exports, module) {
     "use strict";
-    var { Duplex: Duplex2 } = __require("stream");
+    var { Duplex: Duplex3 } = __require("stream");
     var { randomFillSync } = __require("crypto");
     var {
       types: { isUint8Array }
@@ -2124,7 +2124,7 @@ var require_extension = __commonJS({
       if (dest[name] === void 0) dest[name] = [elem];
       else dest[name].push(elem);
     }
-    function parse(header) {
+    function parse2(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -2264,7 +2264,7 @@ var require_extension = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module.exports = { format, parse };
+    module.exports = { format, parse: parse2 };
   }
 });
 
@@ -2272,13 +2272,13 @@ var require_extension = __commonJS({
 var require_websocket = __commonJS({
   "../node_modules/ws/lib/websocket.js"(exports, module) {
     "use strict";
-    var EventEmitter2 = __require("events");
+    var EventEmitter4 = __require("events");
     var https2 = __require("https");
-    var http3 = __require("http");
-    var net3 = __require("net");
+    var http4 = __require("http");
+    var net5 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash3 } = __require("crypto");
-    var { Duplex: Duplex2, Readable: Readable2 } = __require("stream");
+    var { randomBytes: randomBytes10, createHash: createHash5 } = __require("crypto");
+    var { Duplex: Duplex3, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
     var Receiver2 = require_receiver();
@@ -2298,13 +2298,13 @@ var require_websocket = __commonJS({
     var {
       EventTarget: { addEventListener, removeEventListener }
     } = require_event_target();
-    var { format, parse } = require_extension();
+    var { format, parse: parse2 } = require_extension();
     var { toBuffer } = require_buffer_util();
     var kAborted = /* @__PURE__ */ Symbol("kAborted");
     var protocolVersions = [8, 13];
     var readyStates = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
     var subprotocolRegex = /^[!#$%&'*+\-.0-9A-Z^_`|a-z~]+$/;
-    var WebSocket2 = class _WebSocket extends EventEmitter2 {
+    var WebSocket2 = class _WebSocket extends EventEmitter4 {
       /**
        * Create a new `WebSocket`.
        *
@@ -2815,8 +2815,8 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes5(16).toString("base64");
-      const request = isSecure ? https2.request : http3.request;
+      const key = randomBytes10(16).toString("base64");
+      const request2 = isSecure ? https2.request : http4.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
       opts.createConnection = opts.createConnection || (isSecure ? tlsConnect : netConnect);
@@ -2893,12 +2893,12 @@ var require_websocket = __commonJS({
         if (opts.auth && !options.headers.authorization) {
           options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");
         }
-        req = websocket._req = request(opts);
+        req = websocket._req = request2(opts);
         if (websocket._redirects) {
           websocket.emit("redirect", websocket.url, req);
         }
       } else {
-        req = websocket._req = request(opts);
+        req = websocket._req = request2(opts);
       }
       if (opts.timeout) {
         req.on("timeout", () => {
@@ -2945,7 +2945,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket2, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket2, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -2975,7 +2975,7 @@ var require_websocket = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse(secWebSocketExtensions);
+            extensions = parse2(secWebSocketExtensions);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket2, message);
@@ -3019,12 +3019,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net3.connect(options);
+      return net5.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net3.isIP(options.host) ? "" : options.host;
+        options.servername = net5.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -3065,7 +3065,7 @@ var require_websocket = __commonJS({
       websocket._closeCode = code2;
       if (websocket._socket[kWebSocket] === void 0) return;
       websocket._socket.removeListener("data", socketOnData);
-      process.nextTick(resume, websocket._socket);
+      process.nextTick(resume2, websocket._socket);
       if (code2 === 1005) websocket.close();
       else websocket.close(code2, reason);
     }
@@ -3077,7 +3077,7 @@ var require_websocket = __commonJS({
       const websocket = this[kWebSocket];
       if (websocket._socket[kWebSocket] !== void 0) {
         websocket._socket.removeListener("data", socketOnData);
-        process.nextTick(resume, websocket._socket);
+        process.nextTick(resume2, websocket._socket);
         websocket.close(err[kStatusCode]);
       }
       if (!websocket._errorEmitted) {
@@ -3099,7 +3099,7 @@ var require_websocket = __commonJS({
     function receiverOnPong(data) {
       this[kWebSocket].emit("pong", data);
     }
-    function resume(stream) {
+    function resume2(stream) {
       stream.resume();
     }
     function senderOnError(err) {
@@ -3169,7 +3169,7 @@ var require_stream = __commonJS({
   "../node_modules/ws/lib/stream.js"(exports, module) {
     "use strict";
     var WebSocket2 = require_websocket();
-    var { Duplex: Duplex2 } = __require("stream");
+    var { Duplex: Duplex3 } = __require("stream");
     function emitClose(stream) {
       stream.emit("close");
     }
@@ -3187,7 +3187,7 @@ var require_stream = __commonJS({
     }
     function createWebSocketStream2(ws, options) {
       let terminateOnDestroy = true;
-      const duplex = new Duplex2({
+      const duplex = new Duplex3({
         ...options,
         autoDestroy: false,
         emitClose: false,
@@ -3267,7 +3267,7 @@ var require_subprotocol = __commonJS({
   "../node_modules/ws/lib/subprotocol.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
-    function parse(header) {
+    function parse2(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end = -1;
@@ -3303,7 +3303,7 @@ var require_subprotocol = __commonJS({
       protocols.add(protocol);
       return protocols;
     }
-    module.exports = { parse };
+    module.exports = { parse: parse2 };
   }
 });
 
@@ -3311,10 +3311,10 @@ var require_subprotocol = __commonJS({
 var require_websocket_server = __commonJS({
   "../node_modules/ws/lib/websocket-server.js"(exports, module) {
     "use strict";
-    var EventEmitter2 = __require("events");
-    var http3 = __require("http");
-    var { Duplex: Duplex2 } = __require("stream");
-    var { createHash: createHash3 } = __require("crypto");
+    var EventEmitter4 = __require("events");
+    var http4 = __require("http");
+    var { Duplex: Duplex3 } = __require("stream");
+    var { createHash: createHash5 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3324,7 +3324,7 @@ var require_websocket_server = __commonJS({
     var RUNNING = 0;
     var CLOSING = 1;
     var CLOSED = 2;
-    var WebSocketServer2 = class extends EventEmitter2 {
+    var WebSocketServer2 = class extends EventEmitter4 {
       /**
        * Create a `WebSocketServer` instance.
        *
@@ -3393,8 +3393,8 @@ var require_websocket_server = __commonJS({
           );
         }
         if (options.port != null) {
-          this._server = http3.createServer((req, res) => {
-            const body = http3.STATUS_CODES[426];
+          this._server = http4.createServer((req, res) => {
+            const body = http4.STATUS_CODES[426];
             res.writeHead(426, {
               "Content-Length": body.length,
               "Content-Type": "text/plain"
@@ -3621,7 +3621,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket2, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3683,7 +3683,7 @@ var require_websocket_server = __commonJS({
       this.destroy();
     }
     function abortHandshake(socket2, code2, message, headers) {
-      message = message || http3.STATUS_CODES[code2];
+      message = message || http4.STATUS_CODES[code2];
       headers = {
         Connection: "close",
         "Content-Type": "text/html",
@@ -3692,7 +3692,7 @@ var require_websocket_server = __commonJS({
       };
       socket2.once("finish", socket2.destroy);
       socket2.end(
-        `HTTP/1.1 ${code2} ${http3.STATUS_CODES[code2]}\r
+        `HTTP/1.1 ${code2} ${http4.STATUS_CODES[code2]}\r
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
       );
     }
@@ -3739,9 +3739,9 @@ var UsageError = class extends CliError {
   }
 };
 var ApiError = class extends CliError {
-  constructor(status2, message, code2 = null) {
-    super(message, status2 === 401 ? EXIT.AUTH : status2 === 404 ? EXIT.NOT_FOUND : EXIT.FAILURE);
-    this.status = status2;
+  constructor(status3, message, code2 = null) {
+    super(message, status3 === 401 ? EXIT.AUTH : status3 === 404 ? EXIT.NOT_FOUND : EXIT.FAILURE);
+    this.status = status3;
     this.code = code2;
     this.name = "ApiError";
   }
@@ -3868,7 +3868,8 @@ function parseSize(raw) {
 }
 
 // src/version.ts
-var VERSION = true ? "v0.1.8" : "0.0.0-dev";
+var VERSION = true ? "v0.1.10" : "0.0.0-dev";
+var STANDALONE = typeof __AGENTBOX_STANDALONE__ === "boolean" && __AGENTBOX_STANDALONE__;
 var MIN_NODE_MAJOR = 20;
 function nodeMajor(version = process.versions.node) {
   return Number(version.split(".")[0]);
@@ -4082,8 +4083,8 @@ var status = command({
       else if (list.length === 0) row("apps", "none");
       else {
         const isShared = (a) => Boolean(a.visibility?.mode && a.visibility.mode !== "private" && (a.visibility.expiresAt == null || a.visibility.expiresAt > ctx.now()));
-        const shared = list.filter(isShared).length;
-        row("apps", `${list.length}${shared ? ` (${shared} shared)` : ""}`);
+        const shared2 = list.filter(isShared).length;
+        row("apps", `${list.length}${shared2 ? ` (${shared2} shared)` : ""}`);
         const lines = table(
           ["NAME", "PORT", "STATE", "SHARING"],
           list.map((a) => [
@@ -4265,13 +4266,13 @@ var TunnelStream = class extends Duplex {
     this.ws = ws;
     ws.on("message", (data, isBinary) => {
       if (!isBinary) {
-        let control = null;
+        let control2 = null;
         try {
-          control = JSON.parse(data.toString("utf8"));
+          control2 = JSON.parse(data.toString("utf8"));
         } catch {
         }
-        if (control?.type === "error") {
-          const err = new TunnelError(control.message ?? "the tunnel failed");
+        if (control2?.type === "error") {
+          const err = new TunnelError(control2.message ?? "the tunnel failed");
           setImmediate(() => this.destroy(err));
         }
         return;
@@ -4316,8 +4317,8 @@ function openTunnel(client, target, opts = {}) {
     const early = (data, isBinary) => {
       if (isBinary) return;
       try {
-        const control = JSON.parse(data.toString("utf8"));
-        if (control.type === "error") fail(new TunnelError(control.message ?? "the tunnel failed"));
+        const control2 = JSON.parse(data.toString("utf8"));
+        if (control2.type === "error") fail(new TunnelError(control2.message ?? "the tunnel failed"));
       } catch {
       }
     };
@@ -4335,10 +4336,10 @@ function openTunnel(client, target, opts = {}) {
     });
     ws.on("message", early);
     ws.once("unexpected-response", (_req, res) => {
-      const status2 = res.statusCode ?? 0;
+      const status3 = res.statusCode ?? 0;
       res.resume();
       fail(
-        status2 === 401 ? new CliError("the box did not accept this device's sign-in; run `agentbox login` again", EXIT.AUTH) : status2 === 404 ? new CliError(`${client.origin} has no tunnel endpoint yet; update the box`, EXIT.NOT_FOUND) : new TunnelError(`the box refused the tunnel (HTTP ${status2})`)
+        status3 === 401 ? new CliError("the box did not accept this device's sign-in; run `agentbox login` again", EXIT.AUTH) : status3 === 404 ? new CliError(`${client.origin} has no tunnel endpoint yet; update the box`, EXIT.NOT_FOUND) : new TunnelError(`the box refused the tunnel (HTTP ${status3})`)
       );
     });
     ws.once("error", (err) => fail(new CliError(`could not open a tunnel to ${client.origin}: ${err.message}`, EXIT.UNREACHABLE)));
@@ -4528,20 +4529,20 @@ var share = command({
     const body = { mode: passcode ? "passcode" : "link" };
     if (expires !== void 0) body.expiresIn = parseExpiry(expires);
     if (chosen !== void 0) body.passcode = chosen;
-    const shared = await client.json("PUT", `/_gate/apps/${encodeURIComponent(app.id)}/visibility`, {
+    const shared2 = await client.json("PUT", `/_gate/apps/${encodeURIComponent(app.id)}/visibility`, {
       body: { json: body },
       what: `sharing ${app.name}`
     });
     const url = `${box.url}/a/${app.id}/`;
     if (ctx.json) {
-      ctx.printJson({ ...shared, url });
+      ctx.printJson({ ...shared2, url });
       return;
     }
     ctx.out(`${url}
 `);
-    if (shared.passcode) ctx.out(`passcode  ${shared.passcode}
+    if (shared2.passcode) ctx.out(`passcode  ${shared2.passcode}
 `);
-    ctx.err(`${safeText(app.name)} is ${safeText(sharing(shared, ctx.now()))}${shared.passcode ? "; the passcode is shown only this once" : ""}.
+    ctx.err(`${safeText(app.name)} is ${safeText(sharing(shared2, ctx.now()))}${shared2.passcode ? "; the passcode is shown only this once" : ""}.
 `);
   }
 });
@@ -4676,10 +4677,10 @@ function hasBox(boxes2, name) {
 function emptyConfig() {
   return { version: 1, current: null, boxes: boxTable() };
 }
-function configDir(env = process.env, home = os.homedir(), platform = process.platform) {
+function configDir(env = process.env, home2 = os.homedir(), platform = process.platform) {
   if (platform === "win32" && env.APPDATA && path3.win32.isAbsolute(env.APPDATA)) return path3.win32.join(env.APPDATA, "agentbox");
   const xdg = env.XDG_CONFIG_HOME;
-  const base = xdg && path3.isAbsolute(xdg) ? xdg : path3.join(home, ".config");
+  const base = xdg && path3.isAbsolute(xdg) ? xdg : path3.join(home2, ".config");
   return path3.join(base, "agentbox");
 }
 var BOX_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
@@ -4914,7 +4915,7 @@ async function pollForToken(client, start, deps = {}) {
     await wait(delay, deps.signal);
     delay = interval;
     if (now() > deadline) throw new CliError("the code expired before it was approved; run `agentbox login` again");
-    let status2;
+    let status3;
     let body;
     let retryAfter;
     try {
@@ -4924,7 +4925,7 @@ async function pollForToken(client, start, deps = {}) {
         headers: { accept: "application/json" },
         ...deps.signal ? { signal: deps.signal } : {}
       });
-      status2 = res.status;
+      status3 = res.status;
       retryAfter = typeof res.headers["retry-after"] === "string" ? res.headers["retry-after"] : void 0;
       const text = await res.text();
       try {
@@ -4939,17 +4940,17 @@ async function pollForToken(client, start, deps = {}) {
       }
       throw err;
     }
-    if (status2 >= 500) {
-      if (++failures > maxFailures) throw new CliError(`the box kept failing to answer the sign-in (HTTP ${status2}); try again later`);
+    if (status3 >= 500) {
+      if (++failures > maxFailures) throw new CliError(`the box kept failing to answer the sign-in (HTTP ${status3}); try again later`);
       delay = backoff(interval, failures);
       continue;
     }
     failures = 0;
-    if (status2 === 200) {
+    if (status3 === 200) {
       if (typeof body.token === "string" && TOKEN_SHAPE.test(body.token)) return body.token;
       throw new CliError("the box answered with something that is not a device token");
     }
-    if (status2 === 429) {
+    if (status3 === 429) {
       const s = Number(retryAfter);
       if (Number.isFinite(s) && s > 0) await wait(s * 1e3, deps.signal);
       continue;
@@ -4966,7 +4967,7 @@ async function pollForToken(client, start, deps = {}) {
       case "expired_token":
         throw new CliError("the code expired, or was already used; run `agentbox login` again");
       default:
-        throw new CliError(`the box refused the sign-in (HTTP ${status2}${typeof body.error === "string" ? `: ${body.error}` : ""})`);
+        throw new CliError(`the box refused the sign-in (HTTP ${status3}${typeof body.error === "string" ? `: ${body.error}` : ""})`);
     }
   }
 }
@@ -4990,9 +4991,9 @@ import os3 from "node:os";
 import path5 from "node:path";
 
 // ../shared/src/index.ts
-function encodePathParam(path12) {
+function encodePathParam(path22) {
   let out = "";
-  for (const ch of path12) {
+  for (const ch of path22) {
     const cp = ch.codePointAt(0) ?? 0;
     out += cp >= 56448 && cp <= 56575 ? `%${(cp - 56320).toString(16).toUpperCase()}` : encodeURIComponent(ch);
   }
@@ -5064,8 +5065,8 @@ var FilesApi = class {
   copy(from, to, overwrite) {
     return this.client.json("POST", "/api/files/copy", { body: { json: { from, to, overwrite } }, what: `copying ${from}`, idleMs: 6e5 });
   }
-  trash(paths) {
-    return this.client.json("POST", "/api/files/trash", { body: { json: { paths } }, what: "moving to the trash" });
+  trash(paths2) {
+    return this.client.json("POST", "/api/files/trash", { body: { json: { paths: paths2 } }, what: "moving to the trash" });
   }
   startUpload(p, size, overwrite) {
     return this.client.json("POST", "/api/files/uploads", { body: { json: { path: p, size, overwrite } }, what: `uploading to ${p}` });
@@ -5401,8 +5402,8 @@ function readIfThere(file) {
   }
 }
 function tilde(ctx, p) {
-  const home = homeDir(ctx);
-  return p.startsWith(home + path5.sep) ? `~${p.slice(home.length)}` : p;
+  const home2 = homeDir(ctx);
+  return p.startsWith(home2 + path5.sep) ? `~${p.slice(home2.length)}` : p;
 }
 function sshConfigArgs(ctx) {
   const mine = path5.join(sshDir(ctx), "config");
@@ -6404,7 +6405,7 @@ var put = command({
     const force = bool(p.options, "force");
     const chunkRaw = typeof p.options["chunk-size"] === "string" ? parseSize(p.options["chunk-size"]) : MAX_CHUNK;
     if (chunkRaw < 1024 || chunkRaw > MAX_CHUNK) throw new UsageError(`--chunk-size must be from 1K to ${MAX_CHUNK / 1024 / 1024}M`);
-    const resume = new ResumeStore(ctx.config.dir);
+    const resume2 = new ResumeStore(ctx.config.dir);
     let target = await files.stat(remote);
     if (!target && remote.endsWith("/")) target = await files.mkdir(remote);
     const intoDir = isDir(target);
@@ -6419,7 +6420,7 @@ var put = command({
           remote: dest,
           overwrite: force,
           chunkSize: chunkRaw,
-          resume,
+          resume: resume2,
           signal: ctx.abort.signal,
           onProgress: (sent) => bar.update(sent),
           onResume: (received, total) => ctx.err(`${file}: resuming at ${formatBytes(received)} of ${formatBytes(total)}
@@ -6491,7 +6492,7 @@ var rm = command({
   details: "Nothing is deleted outright: restore from Files \u2192 Trash in the app.",
   async run(ctx, p) {
     const files = await filesApi(ctx);
-    const paths = [];
+    const paths2 = [];
     for (const target of p.operands) {
       const e = await files.stat(target);
       if (!e) {
@@ -6499,10 +6500,10 @@ var rm = command({
         throw new CliError(`${target}: no such file or folder on the box`, EXIT.NOT_FOUND);
       }
       if (e.type === "dir" && !bool(p.options, "recursive")) throw new CliError(`${e.path} is a folder; add -r to trash it and everything in it`);
-      paths.push(e.path);
+      paths2.push(e.path);
     }
-    if (paths.length === 0) return;
-    const result = await files.trash(paths);
+    if (paths2.length === 0) return;
+    const result = await files.trash(paths2);
     for (const t2 of result.trashed) ctx.err(`trashed ${safeText(t2.originalPath)}
 `);
   }
@@ -6577,8 +6578,8 @@ function editorCommand(editor, file, platform, env = process.env) {
   if (!CMD_SAFE.test(file)) {
     throw new CliError(`the temporary file's path (${file}) has characters cmd.exe would act on; set TEMP to a plain folder, or use an editor that is an .exe`);
   }
-  const quote = (w) => `"${w.replace(/"/g, "")}"`;
-  return { command: [resolved, ...rest, file].map(quote).join(" "), args: [], shell: true };
+  const quote2 = (w) => `"${w.replace(/"/g, "")}"`;
+  return { command: [resolved, ...rest, file].map(quote2).join(" "), args: [], shell: true };
 }
 function runEditor(editor, file, platform = process.platform, env = process.env) {
   return new Promise((resolve, reject) => {
@@ -6805,14 +6806,3335 @@ var add = command({
 });
 var HERDR_COMMANDS = [add, call, socket];
 
+// src/commands/node.ts
+import { spawn as spawn7 } from "node:child_process";
+import fs20 from "node:fs";
+import os11 from "node:os";
+import path18 from "node:path";
+
+// src/node/control.ts
+import { randomBytes as randomBytes4, timingSafeEqual } from "node:crypto";
+import fs9 from "node:fs";
+import net3 from "node:net";
+
+// src/node/paths.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import fs8 from "node:fs";
+import os7 from "node:os";
+import path9 from "node:path";
+function nodeDir(env = process.env, home2 = os7.homedir(), platform = process.platform) {
+  if (platform === "win32") {
+    const local = env.LOCALAPPDATA && path9.win32.isAbsolute(env.LOCALAPPDATA) ? env.LOCALAPPDATA : path9.win32.join(home2, "AppData", "Local");
+    return path9.win32.join(local, "agentbox", "node");
+  }
+  const xdg = env.XDG_DATA_HOME;
+  const base = xdg && path9.isAbsolute(xdg) ? xdg : path9.join(home2, ".local", "share");
+  return path9.join(base, "agentbox", "node");
+}
+function nodePaths(dir) {
+  return {
+    dir,
+    policy: path9.join(dir, "policy.json"),
+    credentials: path9.join(dir, "credentials.json"),
+    secrets: path9.join(dir, "secrets"),
+    bin: path9.join(dir, "bin"),
+    state: path9.join(dir, "state"),
+    control: path9.join(dir, "control.sock"),
+    controlSecret: path9.join(dir, "control.secret")
+  };
+}
+function ensurePrivateDir(dir) {
+  fs8.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") fs8.chmodSync(dir, 448);
+}
+function writePrivate2(file, contents, mode = 384) {
+  ensurePrivateDir(path9.dirname(file));
+  const tmp = path9.join(path9.dirname(file), `.${path9.basename(file)}.${randomBytes3(6).toString("hex")}.tmp`);
+  const fd = fs8.openSync(tmp, "wx", mode);
+  try {
+    fs8.writeFileSync(fd, contents);
+    if (process.platform !== "win32") fs8.fchmodSync(fd, mode);
+    fs8.fsyncSync(fd);
+  } catch (err) {
+    fs8.closeSync(fd);
+    fs8.rmSync(tmp, { force: true });
+    throw err;
+  }
+  fs8.closeSync(fd);
+  try {
+    fs8.renameSync(tmp, file);
+  } catch (err) {
+    fs8.rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+
+// src/node/control.ts
+var COMMANDS = /* @__PURE__ */ new Set(["status", "pause", "resume", "leave"]);
+async function startControl(socketPath, secretFile, handle) {
+  const secret = randomBytes4(32).toString("base64url");
+  writePrivate2(secretFile, secret);
+  const want = Buffer.from(secret);
+  fs9.rmSync(socketPath, { force: true });
+  const server = net3.createServer((sock) => {
+    let buf = "";
+    sock.setTimeout(1e4, () => sock.destroy());
+    sock.on("error", () => sock.destroy());
+    sock.on("data", (c) => {
+      buf += c.toString("utf8");
+      if (buf.length > 16 * 1024) return sock.destroy();
+      const nl = buf.indexOf("\n");
+      if (nl < 0) return;
+      const reply = (o) => {
+        sock.end(`${JSON.stringify(o)}
+`);
+      };
+      let req;
+      try {
+        req = JSON.parse(buf.slice(0, nl));
+      } catch {
+        return reply({ ok: false, error: "bad request" });
+      }
+      const got = Buffer.from(typeof req.secret === "string" ? req.secret : "");
+      if (got.length !== want.length || !timingSafeEqual(got, want)) return reply({ ok: false, error: "refused" });
+      if (typeof req.command !== "string" || !COMMANDS.has(req.command)) return reply({ ok: false, error: "unknown command" });
+      handle(req.command).then(
+        (out) => reply({ ok: true, ...out }),
+        (err) => reply({ ok: false, error: err.message })
+      );
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  if (process.platform !== "win32") fs9.chmodSync(socketPath, 384);
+  return {
+    close: () => {
+      server.close();
+      fs9.rmSync(socketPath, { force: true });
+    }
+  };
+}
+function callControl(socketPath, secretFile, command2, timeoutMs = 1e4) {
+  let secret;
+  try {
+    secret = fs9.readFileSync(secretFile, "utf8").trim();
+  } catch {
+    return Promise.resolve(null);
+  }
+  return new Promise((resolve) => {
+    const sock = net3.connect(socketPath);
+    let buf = "";
+    const timer = setTimeout(() => {
+      sock.destroy();
+      resolve(null);
+    }, timeoutMs);
+    sock.on("connect", () => sock.write(`${JSON.stringify({ secret, command: command2 })}
+`));
+    sock.on("data", (c) => buf += c.toString("utf8"));
+    sock.on("end", () => {
+      clearTimeout(timer);
+      try {
+        resolve(JSON.parse(buf));
+      } catch {
+        resolve(null);
+      }
+    });
+    sock.on("error", () => {
+      clearTimeout(timer);
+      resolve(null);
+    });
+  });
+}
+
+// src/node/credentials.ts
+import fs10 from "node:fs";
+
+// ../hostcore/src/link/frame.ts
+var FrameType = {
+  open: 1,
+  data: 2,
+  close: 3,
+  window: 4,
+  control: 5
+};
+var TYPES = new Set(Object.values(FrameType));
+var HEADER_BYTES = 5;
+var CONTROL_MAX_BYTES = 64 * 1024;
+var HELLO_MAX_BYTES = 16 * 1024;
+var MAX_STREAM_ID = 4294967295;
+var FrameError = class extends Error {
+};
+function encodeFrame(type, stream, payload = Buffer.alloc(0)) {
+  if (!TYPES.has(type)) throw new FrameError(`unknown frame type ${type}`);
+  if (!Number.isInteger(stream) || stream < 0 || stream > MAX_STREAM_ID) throw new FrameError(`bad stream id ${stream}`);
+  if (type === FrameType.control && stream !== 0) throw new FrameError("control frames are on stream 0");
+  if (type !== FrameType.control && stream === 0) throw new FrameError("stream 0 is the link's own");
+  const out = Buffer.allocUnsafe(HEADER_BYTES + payload.length);
+  out.writeUInt8(type, 0);
+  out.writeUInt32BE(stream, 1);
+  out.set(payload, HEADER_BYTES);
+  return out;
+}
+function decodeFrame(buf) {
+  if (buf.length < HEADER_BYTES) throw new FrameError("frame too short");
+  const type = buf.readUInt8(0);
+  if (!TYPES.has(type)) throw new FrameError(`unknown frame type ${type}`);
+  const stream = buf.readUInt32BE(1);
+  const payload = buf.subarray(HEADER_BYTES);
+  if (type === FrameType.control) {
+    if (stream !== 0) throw new FrameError("control frames are on stream 0");
+    if (payload.length > CONTROL_MAX_BYTES) throw new FrameError("control message too large");
+  } else if (stream === 0) {
+    throw new FrameError("stream 0 is the link's own");
+  }
+  return { type, stream, payload };
+}
+function encodeControl(message) {
+  const json2 = Buffer.from(JSON.stringify(message), "utf8");
+  if (json2.length > CONTROL_MAX_BYTES) throw new FrameError("control message too large");
+  return encodeFrame(FrameType.control, 0, json2);
+}
+function decodeControl(payload) {
+  let value;
+  try {
+    value = JSON.parse(payload.toString("utf8"));
+  } catch {
+    throw new FrameError("control message is not JSON");
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new FrameError("control message is not an object");
+  const type = value.type;
+  if (typeof type !== "string" || type === "") throw new FrameError("control message has no type");
+  return value;
+}
+
+// ../hostcore/src/link/protocol.ts
+import { createHash as createHash3, createHmac, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var PROTOCOL_VERSION = 1;
+var LINK_PATH = "/_gate/node";
+var DUPLICATE_BACKOFF_MS = 5 * 6e4;
+var NODE_TOKEN_SHAPE = /^abn_[A-Za-z0-9_-]{43}$/;
+function tokenDigest(token) {
+  return createHash3("sha256").update(token).digest("hex");
+}
+function revokeMac(tokenDigestHex, machineId, nonce) {
+  return createHmac("sha256", tokenDigestHex).update(`agentbox-revoked
+${machineId}
+${nonce}`).digest("hex");
+}
+function verifyRevoke(token, machineId, nonce, mac) {
+  if (typeof mac !== "string" || !/^[0-9a-f]{64}$/.test(mac)) return false;
+  const want = Buffer.from(revokeMac(tokenDigest(token), machineId, nonce), "hex");
+  return timingSafeEqual2(want, Buffer.from(mac, "hex"));
+}
+
+// ../hostcore/src/link/stream.ts
+import { Duplex as Duplex2 } from "node:stream";
+var STREAM_WINDOW = 256 * 1024;
+var DATA_CHUNK = 64 * 1024;
+var STREAM_BUDGET = 64 * 1024 * 1024;
+function decodeOpen(payload) {
+  let v = {};
+  try {
+    v = JSON.parse(payload.toString("utf8"));
+  } catch {
+  }
+  const id = (s) => typeof s === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(s) ? s : null;
+  return { kind: v.kind === "upgrade" ? "upgrade" : "http", session: id(v.session), grant: id(v.grant) };
+}
+function windowPayload(n) {
+  const b = Buffer.allocUnsafe(4);
+  b.writeUInt32BE(n, 0);
+  return b;
+}
+var LinkStream = class extends Duplex2 {
+  constructor(id, sendFrame, window = STREAM_WINDOW) {
+    super({ allowHalfOpen: false });
+    this.id = id;
+    this.sendFrame = sendFrame;
+    this.window = window;
+    this.credit = window;
+    this.allowance = window;
+  }
+  id;
+  sendFrame;
+  window;
+  /** Bytes the peer will still take from us. */
+  credit;
+  /** Bytes the peer may still send us before it must wait for a window frame. */
+  allowance;
+  /** Bytes received and pushed to our reader, not yet credited back. */
+  unacked = 0;
+  pending = null;
+  remoteClosed = false;
+  closeSent = false;
+  // What net.Socket has and Node's HTTP server, its client and `ws` call.
+  setTimeout(_ms, cb) {
+    if (cb) this.once("timeout", cb);
+    return this;
+  }
+  setNoDelay() {
+    return this;
+  }
+  setKeepAlive() {
+    return this;
+  }
+  ref() {
+    return this;
+  }
+  unref() {
+    return this;
+  }
+  /** A frame for this stream, from the link. */
+  receive(frame) {
+    if (this.destroyed) return;
+    switch (frame.type) {
+      case FrameType.data: {
+        if (this.remoteClosed) return;
+        const n = frame.payload.length;
+        if (n === 0) return;
+        this.allowance -= n;
+        if (this.allowance < 0) {
+          this.destroy(new Error("the far end sent past its window"));
+          return;
+        }
+        this.unacked += n;
+        if (this.push(Buffer.from(frame.payload)) && this.unacked >= this.window / 4) this.grant();
+        return;
+      }
+      case FrameType.window: {
+        if (frame.payload.length !== 4) {
+          this.destroy(new Error("bad window frame"));
+          return;
+        }
+        this.credit += frame.payload.readUInt32BE(0);
+        if (this.credit > this.window * 4) {
+          this.destroy(new Error("the far end widened the window past any it was given"));
+          return;
+        }
+        this.flush();
+        return;
+      }
+      case FrameType.close:
+        this.remoteEnd();
+        return;
+      default:
+        return;
+    }
+  }
+  /** The far end is gone (its close, or the link's end). */
+  remoteEnd() {
+    if (this.remoteClosed) return;
+    this.remoteClosed = true;
+    this.closeSent = true;
+    const p = this.pending;
+    this.pending = null;
+    p?.cb();
+    this.push(null);
+    if (this.readableLength === 0) setImmediate(() => this.destroy());
+    else this.once("end", () => this.destroy());
+  }
+  grant() {
+    if (this.unacked <= 0 || this.remoteClosed || this.closeSent) return;
+    const n = this.unacked;
+    this.unacked = 0;
+    this.allowance += n;
+    this.sendFrame(encodeFrame(FrameType.window, this.id, windowPayload(n)));
+  }
+  _read() {
+    this.grant();
+  }
+  flush() {
+    const p = this.pending;
+    if (!p) return;
+    this.pending = null;
+    this.sendChunks(p.chunk, p.cb);
+  }
+  sendChunks(chunk, cb) {
+    let off = 0;
+    while (off < chunk.length) {
+      if (this.remoteClosed) return cb();
+      if (this.credit <= 0) {
+        this.pending = { chunk: chunk.subarray(off), cb };
+        return;
+      }
+      const n = Math.min(chunk.length - off, this.credit, DATA_CHUNK);
+      this.sendFrame(encodeFrame(FrameType.data, this.id, chunk.subarray(off, off + n)));
+      this.credit -= n;
+      off += n;
+    }
+    cb();
+  }
+  _write(chunk, _enc, cb) {
+    if (this.remoteClosed) return cb();
+    this.sendChunks(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk), cb);
+  }
+  _final(cb) {
+    this.sendClose();
+    cb();
+    if (!this.remoteClosed) {
+      this.remoteClosed = true;
+      this.push(null);
+      if (this.readableLength === 0) setImmediate(() => this.destroy());
+      else this.once("end", () => this.destroy());
+    }
+  }
+  _destroy(err, cb) {
+    this.sendClose();
+    const p = this.pending;
+    this.pending = null;
+    p?.cb(err ?? new Error("stream closed"));
+    cb(err);
+  }
+  sendClose() {
+    if (this.closeSent) return;
+    this.closeSent = true;
+    try {
+      this.sendFrame(encodeFrame(FrameType.close, this.id));
+    } catch {
+    }
+  }
+};
+var StreamTable = class {
+  constructor(sendFrame, window = STREAM_WINDOW) {
+    this.sendFrame = sendFrame;
+    this.window = window;
+  }
+  sendFrame;
+  window;
+  streams = /* @__PURE__ */ new Map();
+  get size() {
+    return this.streams.size;
+  }
+  has(id) {
+    return this.streams.has(id);
+  }
+  open(id) {
+    if (this.streams.has(id)) throw new Error(`stream ${id} is open already`);
+    const s = new LinkStream(id, this.sendFrame, this.window);
+    this.streams.set(id, s);
+    s.once("close", () => {
+      if (this.streams.get(id) === s) this.streams.delete(id);
+    });
+    s.on("error", () => {
+    });
+    return s;
+  }
+  /** Route a data, window or close frame; false when no such stream is open. */
+  receive(frame) {
+    const s = this.streams.get(frame.stream);
+    if (!s) return false;
+    s.receive(frame);
+    return true;
+  }
+  /** The link ended: every stream with it. */
+  endAll(reason) {
+    for (const s of [...this.streams.values()]) {
+      s.remoteEnd();
+      s.destroy(new Error(reason));
+    }
+    this.streams.clear();
+  }
+};
+
+// src/node/credentials.ts
+function readCredentials(file) {
+  let raw;
+  try {
+    raw = fs10.readFileSync(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+  let c;
+  try {
+    c = JSON.parse(raw);
+  } catch {
+    throw new CliError(`${file} is not valid JSON; this machine cannot link until it is fixed or re-joined`);
+  }
+  const p = c.presence;
+  if (c.version !== 1 || typeof c.box !== "string" || typeof c.machineId !== "string" || typeof c.name !== "string" || typeof c.token !== "string" || !NODE_TOKEN_SHAPE.test(c.token) || !p || typeof p.salt !== "string" || typeof p.key !== "string" || typeof p.iterations !== "number") {
+    throw new CliError(`${file} is not a node's credentials; re-join this machine`);
+  }
+  return c;
+}
+function writeCredentials(file, c) {
+  writePrivate2(file, `${JSON.stringify(c, null, 2)}
+`);
+}
+
+// src/node/claude.ts
+import fs12 from "node:fs";
+import path11 from "node:path";
+
+// ../../images/machine/agents.md
+var agents_default = "# You are working on {{machine}}, through agentbox\n\n{{machine}} is one of the owner's own computers, joined to their agentbox. You\nrun here as the owner, with their files, their tools and their network. The\nowner watches your terminal from their browser, on agentbox's machines page.\n\n- **To show the owner an app** you started (a dev server, say), tell them the\n  port it listens on; they open it themselves.\n- **Never make anything public.** Do not use tunnels (ngrok, cloudflared,\n  localtunnel), external hosting, claude.ai Artifacts or similar to show a web\n  app unless the owner explicitly asks for that.\n- **Docker and ports are this machine's own.** Containers you start and ports\n  you listen on are on {{machine}}, not in an agentbox sandbox; clean up what\n  you start.\n";
+
+// src/node/update.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import crypto2 from "node:crypto";
+import fs11 from "node:fs";
+import path10 from "node:path";
+
+// src/node/release-keys.ts
+var RELEASE_PUBLIC_KEYS = [
+  // current
+  `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAQP6eEvWwcx5ptR56iFAJvDISpDYvy2oWOYNTH9KMUzw=
+-----END PUBLIC KEY-----`,
+  // next (rotation)
+  `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEANhmTV3Z/SVIUjCBjFrK+nZpl3Y2ck7vRex7l5CixSDU=
+-----END PUBLIC KEY-----`
+];
+
+// src/node/update-verify.ts
+import crypto from "node:crypto";
+var MACHINE_PLATFORMS = ["linux-x64", "linux-arm64", "win-x64"];
+var UpdateRefused = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UpdateRefused";
+  }
+};
+function machinePlatform(platform = process.platform, arch = process.arch) {
+  const k = `${platform === "win32" ? "win" : platform}-${arch}`;
+  return MACHINE_PLATFORMS.includes(k) ? k : null;
+}
+function parseVersion(v) {
+  const m = /^v?(\d{1,9})\.(\d{1,9})\.(\d{1,9})$/.exec(v);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function compareVersions(a, b) {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+function verifyManifest(bytes, signature, keys) {
+  if (keys.length === 0) {
+    throw new UpdateRefused(
+      "this build of agentbox has no release keys built in, so it cannot check that an update is genuine; it does not update itself (install a release build from https://github.com/jabezpauls/agentbox/releases)"
+    );
+  }
+  const text = (Buffer.isBuffer(signature) ? signature.toString("utf8") : signature ?? "").trim();
+  const sig = /^[A-Za-z0-9+/]{86}==$/.test(text) ? Buffer.from(text, "base64") : null;
+  if (!sig || sig.length !== 64) throw new UpdateRefused("the release manifest is not signed (no valid signature beside it); not updating");
+  const trusted = keys.some((pem) => {
+    try {
+      const key = crypto.createPublicKey(pem);
+      return key.asymmetricKeyType === "ed25519" && crypto.verify(null, bytes, key, sig);
+    } catch {
+      return false;
+    }
+  });
+  if (!trusted) throw new UpdateRefused("the release manifest is not signed by a release key this node trusts; not updating");
+  return parseManifest(bytes);
+}
+var HEX64 = /^[0-9a-f]{64}$/;
+function asset(v, where, versioned) {
+  const a = v;
+  if (!a || typeof a !== "object") throw new UpdateRefused(`the release manifest has no ${where}`);
+  if (typeof a.url !== "string" || !/^https:\/\//.test(a.url)) throw new UpdateRefused(`the release manifest's ${where} has no https URL`);
+  if (typeof a.sha256 !== "string" || !HEX64.test(a.sha256)) throw new UpdateRefused(`the release manifest's ${where} has no SHA-256`);
+  const out = { url: a.url, sha256: a.sha256 };
+  if (typeof a.size === "number" && Number.isSafeInteger(a.size) && a.size > 0) out.size = a.size;
+  if (!versioned) return out;
+  if (typeof a.version !== "string" || !/^[0-9A-Za-z.+-]{1,64}$/.test(a.version)) throw new UpdateRefused(`the release manifest's ${where} has no version`);
+  const entry = { ...out, version: a.version };
+  if (a.files !== void 0) {
+    const f = a.files;
+    if (!f || typeof f !== "object" || !Object.values(f).every((d) => typeof d === "string" && HEX64.test(d))) {
+      throw new UpdateRefused(`the release manifest's ${where} lists files without a SHA-256 each`);
+    }
+    entry.files = f;
+  }
+  return entry;
+}
+function parseManifest(bytes) {
+  let raw;
+  try {
+    raw = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new UpdateRefused("the release manifest is not JSON");
+  }
+  if (!raw || typeof raw !== "object" || raw.schema !== 1) throw new UpdateRefused("the release manifest is of a kind this node does not know; update it by hand");
+  if (typeof raw.version !== "string" || !parseVersion(raw.version)) throw new UpdateRefused("the release manifest has no version");
+  const platforms = {};
+  const given = raw.platforms ?? {};
+  for (const p of MACHINE_PLATFORMS) {
+    const e = given[p];
+    if (!e) continue;
+    const entry = {
+      node: asset(e.node, `${p} node`, false),
+      herdr: asset(e.herdr, `${p} herdr`, true),
+      claude: asset(e.claude, `${p} Claude Code`, true)
+    };
+    if (e.nodeGui !== void 0) entry.nodeGui = asset(e.nodeGui, `${p} windowless node`, false);
+    platforms[p] = entry;
+  }
+  return { schema: 1, version: raw.version, platforms };
+}
+
+// src/node/update.ts
+var RELEASES_URL = "https://github.com/jabezpauls/agentbox/releases/latest/download";
+var MANIFEST_FILE = "machines-manifest.json";
+var SIGNATURE_FILE = "machines-manifest.json.sig";
+var MAX_MANIFEST = 256 * 1024;
+var MAX_SIGNATURE = 4 * 1024;
+var MAX_ASSET = 1024 * 1024 * 1024;
+function describeReport(r) {
+  const tools = (t2) => [t2.herdr === "deferred" || t2.claude === "deferred" ? "herdr and Claude Code are updated once no agent is running" : "", t2.herdr === "updated" ? "herdr updated" : "", t2.claude === "updated" ? "Claude Code updated" : ""].filter(Boolean).join("; ");
+  switch (r.state) {
+    case "off":
+      return "updates are off (policy.json)";
+    case "current": {
+      const t2 = tools(r.tools);
+      return `up to date (agentbox ${r.version})${t2 ? `; ${t2}` : ""}`;
+    }
+    case "available":
+      return `agentbox ${r.version} is available (this is ${r.from}); updates are set to notify, so run it by hand or set "updates": "auto"`;
+    case "updated": {
+      const t2 = tools(r.tools);
+      return `updated agentbox ${r.from} \u2192 ${r.version}${r.restart ? ", restarting" : ""}${t2 ? `; ${t2}` : ""}`;
+    }
+  }
+}
+async function fetchLimited(fetcher, url, max, what) {
+  const res = await fetcher(url, { redirect: "follow" });
+  if (res.status === 404) return null;
+  if (!res.ok || !res.body) throw new Error(`${what}: HTTP ${res.status} from ${url}`);
+  const chunks = [];
+  let size = 0;
+  for await (const c of res.body) {
+    size += c.length;
+    if (size > max) throw new UpdateRefused(`${what} is larger than any real one; not updating`);
+    chunks.push(Buffer.from(c));
+  }
+  return Buffer.concat(chunks);
+}
+async function fetchManifest(o = {}) {
+  const keys = o.keys ?? RELEASE_PUBLIC_KEYS;
+  if (keys.length === 0) verifyManifest(Buffer.alloc(0), null, keys);
+  const fetcher = o.fetch ?? globalThis.fetch;
+  const base = o.releasesUrl ?? RELEASES_URL;
+  const bytes = await fetchLimited(fetcher, `${base}/${MANIFEST_FILE}`, MAX_MANIFEST, "the release manifest");
+  if (!bytes) throw new UpdateRefused("the latest release has no machines manifest");
+  const sig = await fetchLimited(fetcher, `${base}/${SIGNATURE_FILE}`, MAX_SIGNATURE, "the manifest's signature");
+  return verifyManifest(bytes, sig, keys);
+}
+async function downloadVerified(fetcher, asset2, dest, what) {
+  const dir = path10.dirname(dest);
+  fs11.mkdirSync(dir, { recursive: true });
+  const tmp = path10.join(dir, `.${path10.basename(dest)}.update-${crypto2.randomBytes(4).toString("hex")}`);
+  const hash = crypto2.createHash("sha256");
+  let fd = null;
+  try {
+    const res = await fetcher(asset2.url, { redirect: "follow" });
+    if (!res.ok || !res.body) throw new Error(`${what}: HTTP ${res.status} from ${asset2.url}`);
+    fd = fs11.openSync(tmp, "wx", 448);
+    let size = 0;
+    for await (const c of res.body) {
+      size += c.length;
+      if (size > (asset2.size ?? MAX_ASSET) || size > MAX_ASSET) throw new UpdateRefused(`${what} is larger than the manifest says; not installing it`);
+      hash.update(c);
+      fs11.writeSync(fd, c);
+    }
+    fs11.closeSync(fd);
+    fd = null;
+    const got = hash.digest("hex");
+    if (got !== asset2.sha256) throw new UpdateRefused(`${what} does not match the signed manifest (SHA-256 ${got}, expected ${asset2.sha256}); not installing it`);
+    fs11.chmodSync(tmp, 493);
+    return tmp;
+  } catch (err) {
+    if (fd !== null) fs11.closeSync(fd);
+    fs11.rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+function replaceFile(tmp, dest, platform = process.platform) {
+  try {
+    if (platform === "win32" && fs11.existsSync(dest)) {
+      const old = `${dest}.old`;
+      fs11.rmSync(old, { force: true });
+      fs11.renameSync(dest, old);
+    }
+    fs11.renameSync(tmp, dest);
+  } catch (err) {
+    fs11.rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+function defaultCheckRuns(file, version) {
+  const out = spawnSync2(file, ["--version"], { encoding: "utf8", timeout: 3e4, windowsHide: true });
+  const said = (out.stdout ?? "").trim();
+  if (out.status !== 0 || said !== `agentbox ${version}`) {
+    throw new UpdateRefused(`the downloaded agentbox does not run here, or is not ${version} (it said ${JSON.stringify(said.slice(0, 100))}); not installing it`);
+  }
+}
+async function updateTool(o, fetcher, platform, name, installed, asset2, idle) {
+  if (!installed) return "none";
+  if (installed.version === asset2.version) return "current";
+  if (asset2.files) return "unsupported";
+  if (!idle) return "deferred";
+  const tmp = await downloadVerified(fetcher, asset2, installed.path, `${name} ${asset2.version} for ${platform}`);
+  replaceFile(tmp, installed.path, o.platform ?? process.platform);
+  if (installed.versionFile) fs11.writeFileSync(installed.versionFile, `${asset2.version}
+`, { mode: 384 });
+  return "updated";
+}
+async function checkForUpdate(o) {
+  if (o.policy === "off") return { state: "off" };
+  const running = parseVersion(o.running);
+  if (!running) throw new UpdateRefused(`this node's version (${o.running}) is not a release's, so it cannot tell what is newer; install a release build`);
+  const platform = machinePlatform(o.platform ?? process.platform, o.arch ?? process.arch);
+  if (!platform) throw new UpdateRefused(`no agentbox release is built for ${o.platform ?? process.platform}-${o.arch ?? process.arch}`);
+  const fetcher = o.fetch ?? globalThis.fetch;
+  const manifest = await fetchManifest(o);
+  const order = compareVersions(parseVersion(manifest.version), running);
+  if (order < 0) throw new UpdateRefused(`the latest release (${manifest.version}) is older than this node (${o.running}); not going back`);
+  const assets = manifest.platforms[platform];
+  if (!assets) throw new UpdateRefused(`the release ${manifest.version} has nothing for ${platform}`);
+  const newer = order > 0;
+  if (newer && o.policy === "notify") return { state: "available", version: manifest.version, from: o.running };
+  const tools = async () => {
+    const needed = [o.herdr && o.herdr.version !== assets.herdr.version, o.claude && o.claude.version !== assets.claude.version].some(Boolean);
+    const idle = needed && o.policy === "auto" && o.idle ? await o.idle() : false;
+    return {
+      herdr: await updateTool(o, fetcher, platform, "herdr", o.herdr, assets.herdr, idle),
+      claude: await updateTool(o, fetcher, platform, "Claude Code", o.claude, assets.claude, idle)
+    };
+  };
+  if (!newer) return { state: "current", version: o.running, tools: o.policy === "auto" ? await tools() : { herdr: "none", claude: "none" } };
+  if (o.nodePath === null) return { state: "available", version: manifest.version, from: o.running };
+  const node = await downloadVerified(fetcher, assets.node, o.nodePath, `agentbox ${manifest.version} for ${platform}`);
+  let gui = null;
+  try {
+    (o.checkRuns ?? defaultCheckRuns)(node, manifest.version);
+    if (o.nodeGuiPath && assets.nodeGui) gui = await downloadVerified(fetcher, assets.nodeGui, o.nodeGuiPath, `agentbox-node.exe ${manifest.version}`);
+  } catch (err) {
+    fs11.rmSync(node, { force: true });
+    throw err;
+  }
+  replaceFile(node, o.nodePath, o.platform ?? process.platform);
+  if (gui && o.nodeGuiPath) replaceFile(gui, o.nodeGuiPath, o.platform ?? process.platform);
+  return { state: "updated", version: manifest.version, from: o.running, restart: true, tools: await tools() };
+}
+
+// src/node/claude.ts
+var CLAUDE_VERSION = "2.1.311";
+var CLAUDE_PINS = {
+  "linux-x64": { path: "linux-x64/claude", sha256: "86dc1fcc69498159eaf15f446613e847010f9036bfbbdffd4c49350be8489ada", size: 293776752 },
+  "linux-arm64": { path: "linux-arm64/claude", sha256: "2e2496c9a8065df93acb0fca2d341f59a6b8777649b2e025ab8c9bcd5eef61f3", size: 293658808 },
+  "win32-x64": { path: "win32-x64/claude.exe", sha256: "966f4b2ce962298f5dee6a942e8c47c8f97392e69e728e622319a98b259c0680", size: 298870432 }
+};
+var CLAUDE_RELEASES = "https://downloads.claude.ai/claude-code-releases";
+function claudePaths(p, platform = process.platform) {
+  const exe = platform === "win32" ? "claude.exe" : "claude";
+  return {
+    bin: path11.join(p.bin, exe),
+    versionFile: path11.join(p.bin, "claude.version"),
+    config: path11.join(p.dir, "claude"),
+    shims: path11.join(p.dir, "shims"),
+    shim: path11.join(p.dir, "shims", "claude"),
+    agents: path11.join(p.dir, "agents.md"),
+    token: path11.join(p.secrets, "claude-token")
+  };
+}
+function writeIfAbsent(file, contents) {
+  if (fs12.existsSync(file)) return false;
+  writePrivate2(file, contents);
+  return true;
+}
+function seedClaudeConfig(c, home2) {
+  ensurePrivateDir(c.config);
+  writeIfAbsent(path11.join(c.config, ".claude.json"), `${JSON.stringify({ hasCompletedOnboarding: true, projects: { [home2]: { hasTrustDialogAccepted: true } } }, null, 2)}
+`);
+  writeIfAbsent(path11.join(c.config, "settings.json"), `${JSON.stringify({ disableDeepLinkRegistration: "disable" }, null, 2)}
+`);
+}
+function agentsText(machine) {
+  return agents_default.replaceAll("{{machine}}", machine.replace(/[^\w.-]/g, ""));
+}
+function shQuote(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+var PLAIN = ["mcp", "config", "doctor", "update", "install", "setup-token", "migrate-installer", "plugin", "-v", "--version", "-h", "--help"];
+function shimText(c) {
+  return `#!/bin/sh
+# agentbox: Claude Code on this machine. Written by the node; rewritten at
+# every start. Reads the shared sign-in (when this machine was given it) at
+# each launch, for this process only.
+CLAUDE_CONFIG_DIR=${shQuote(c.config)}
+DISABLE_UPDATES=1
+export CLAUDE_CONFIG_DIR DISABLE_UPDATES
+if [ -f ${shQuote(c.token)} ]; then
+  CLAUDE_CODE_OAUTH_TOKEN="$(cat ${shQuote(c.token)})"
+  export CLAUDE_CODE_OAUTH_TOKEN
+fi
+if [ ! -x ${shQuote(c.bin)} ]; then
+  echo "agentbox: Claude Code is not installed on this machine yet (it is installed by \`agentbox node join\`)." >&2
+  exit 127
+fi
+case "\${1:-}" in
+  ${PLAIN.join("|")}) exec ${shQuote(c.bin)} "$@" ;;
+esac
+exec ${shQuote(c.bin)} --append-system-prompt-file ${shQuote(c.agents)} "$@"
+`;
+}
+function prepareClaude(c, o) {
+  seedClaudeConfig(c, o.home);
+  writePrivate2(c.agents, agentsText(o.machine));
+  ensurePrivateDir(c.shims);
+  writePrivate2(c.shim, shimText(c), 448);
+}
+function holdToken(c, token) {
+  if (token === null) {
+    fs12.rmSync(c.token, { force: true });
+    return;
+  }
+  if (!/^[A-Za-z0-9_\-.~+/=]{20,512}$/.test(token)) return;
+  writePrivate2(c.token, token);
+}
+function installedClaude(c) {
+  if (!fs12.existsSync(c.bin)) return null;
+  try {
+    const v = fs12.readFileSync(c.versionFile, "utf8").trim();
+    return parseVersion(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+async function installClaude(c, deps) {
+  const have = installedClaude(c);
+  const want = parseVersion(CLAUDE_VERSION);
+  if (have && compareVersions(parseVersion(have), want) >= 0) return have;
+  const key = `${deps.platform}-${deps.arch}`;
+  const pin = CLAUDE_PINS[key];
+  if (!pin) throw new CliError(`Claude Code ${CLAUDE_VERSION} has no build for ${deps.platform}/${deps.arch} that this node knows`);
+  deps.log?.(`Installing Claude Code ${CLAUDE_VERSION} (about ${Math.round(pin.size / 2 ** 20)} MiB)\u2026
+`);
+  const tmp = await downloadVerified(
+    deps.fetch ?? globalThis.fetch,
+    { url: `${CLAUDE_RELEASES}/${CLAUDE_VERSION}/${pin.path}`, sha256: pin.sha256, size: pin.size },
+    c.bin,
+    `Claude Code ${CLAUDE_VERSION}`
+  );
+  replaceFile(tmp, c.bin);
+  writePrivate2(c.versionFile, `${CLAUDE_VERSION}
+`);
+  return CLAUDE_VERSION;
+}
+
+// src/node/install.ts
+import { createHash as createHash4 } from "node:crypto";
+import fs13 from "node:fs";
+import path12 from "node:path";
+var HERDR_VERSION = "0.9.3";
+var HERDR_PINS = {
+  "linux-x64": { asset: "herdr-linux-x86_64", sha256: "18a8dc65f1c2fa485884344356dea1cfd911c6f06cf46fa78e193f4087f4dba7" },
+  "linux-arm64": { asset: "herdr-linux-aarch64", sha256: "4de7aa3e25678812e92960de64f7c2aaa1bca1f0f80a3c5e559837e231e1f5c0" }
+};
+function sha256(bytes) {
+  return createHash4("sha256").update(bytes).digest("hex");
+}
+async function fetchBytes(url) {
+  let res;
+  try {
+    res = await fetch(url, { redirect: "follow" });
+  } catch (err) {
+    throw new CliError(`could not download ${url}: ${err.message}`);
+  }
+  if (!res.ok) throw new CliError(`could not download ${url}: HTTP ${res.status}`);
+  return new Uint8Array(await res.arrayBuffer());
+}
+async function installHerdr(binDir, deps) {
+  const pin = HERDR_PINS[`${deps.platform}-${deps.arch}`];
+  if (!pin) throw new CliError(`herdr ${HERDR_VERSION} has no build for ${deps.platform}/${deps.arch} that this node knows`);
+  const target = path12.join(binDir, "herdr");
+  try {
+    if (sha256(fs13.readFileSync(target)) === pin.sha256) return target;
+  } catch {
+  }
+  const url = `https://github.com/herdrdev/herdr/releases/download/v${HERDR_VERSION}/${pin.asset}`;
+  deps.log?.(`Installing herdr ${HERDR_VERSION}\u2026
+`);
+  const bytes = deps.from ? new Uint8Array(fs13.readFileSync(deps.from)) : await (deps.download ?? fetchBytes)(url);
+  const got = sha256(bytes);
+  if (got !== pin.sha256) throw new CliError(`herdr ${HERDR_VERSION} failed verification (SHA-256 ${got}, expected ${pin.sha256}); nothing was installed`);
+  writePrivate2(target, bytes, 448);
+  return target;
+}
+
+// src/node/join.ts
+import fs15 from "node:fs";
+
+// src/node/policy.ts
+import fs14 from "node:fs";
+import path13 from "node:path";
+var DENY_ALL = { terminals: false, files: [], ports: false, share: false, updates: "auto", presenceHours: 12, paused: false };
+var KEYS = /* @__PURE__ */ new Set(["terminals", "files", "ports", "share", "updates", "presenceHours", "paused"]);
+function broken(problem) {
+  return { policy: { ...DENY_ALL, files: [] }, problem };
+}
+function expand(p, home2) {
+  if (p === "~") return home2;
+  if (p.startsWith("~/")) return path13.join(home2, p.slice(2));
+  return p;
+}
+function parsePolicy(text, home2) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    return broken("policy.json is not valid JSON");
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return broken("policy.json is not an object");
+  const o = raw;
+  for (const k of Object.keys(o)) if (!KEYS.has(k)) return broken(`policy.json has "${k}", which this node does not know`);
+  const policy = { ...DENY_ALL, files: [] };
+  for (const k of ["terminals", "ports", "share", "paused"]) {
+    if (o[k] === void 0) continue;
+    if (typeof o[k] !== "boolean") return broken(`policy.json: "${k}" must be true or false`);
+    policy[k] = o[k];
+  }
+  if (o.updates !== void 0) {
+    if (o.updates !== "auto" && o.updates !== "notify" && o.updates !== "off") return broken('policy.json: "updates" must be "auto", "notify" or "off"');
+    policy.updates = o.updates;
+  }
+  if (o.presenceHours !== void 0) {
+    const h = o.presenceHours;
+    if (typeof h !== "number" || !Number.isInteger(h) || h < 1 || h > 24) return broken('policy.json: "presenceHours" must be a whole number from 1 to 24');
+    policy.presenceHours = h;
+  }
+  if (o.files !== void 0) {
+    if (!Array.isArray(o.files)) return broken('policy.json: "files" must be a list');
+    for (const f of o.files) {
+      const e = f ?? {};
+      if (typeof e.path !== "string" || e.path === "") return broken('policy.json: every "files" entry needs a "path"');
+      if (e.mode !== "read" && e.mode !== "write") return broken(`policy.json: "${e.path}" needs a "mode" of "read" or "write"`);
+      const full = expand(e.path, home2);
+      if (!path13.isAbsolute(full)) return broken(`policy.json: "${e.path}" is not an absolute folder (or ~/\u2026)`);
+      policy.files.push({ path: path13.normalize(full), mode: e.mode });
+    }
+  }
+  return { policy, problem: null };
+}
+function loadPolicy(file, home2) {
+  let text;
+  try {
+    text = fs14.readFileSync(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return broken("there is no policy.json");
+    return broken(`policy.json cannot be read (${err.code ?? "error"})`);
+  }
+  return parsePolicy(text, home2);
+}
+function summarize(l) {
+  return { ...l.policy, files: l.policy.files.map((f) => ({ ...f })), problem: l.problem };
+}
+function watchPolicy(file, home2, onChange, intervalMs = 1e3) {
+  let last = JSON.stringify(loadPolicy(file, home2));
+  const check = () => {
+    const now = loadPolicy(file, home2);
+    const s = JSON.stringify(now);
+    if (s === last) return;
+    last = s;
+    onChange(now);
+  };
+  const timer = setInterval(check, intervalMs);
+  timer.unref();
+  return () => clearInterval(timer);
+}
+function writeInitialPolicy(file, folders) {
+  if (fs14.existsSync(file)) return false;
+  const policy = { ...DENY_ALL, terminals: true, files: folders };
+  writePrivate2(file, `${JSON.stringify(policy, null, 2)}
+`);
+  return true;
+}
+function setPaused(file, paused) {
+  let o;
+  try {
+    o = JSON.parse(fs14.readFileSync(file, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") o = { ...DENY_ALL };
+    else throw new CliError(`${file} is not valid JSON; fix it first (everything is denied meanwhile)`);
+  }
+  if (typeof o !== "object" || o === null || Array.isArray(o)) throw new CliError(`${file} is not a policy; fix it first`);
+  o.paused = paused;
+  writePrivate2(file, `${JSON.stringify(o, null, 2)}
+`);
+}
+
+// src/node/join.ts
+var MIN_FREE_BYTES = 512 * 1024 * 1024;
+var SUPPORTED_PLATFORMS = /* @__PURE__ */ new Set(["linux"]);
+async function joinMachine(o, s) {
+  const existing = readCredentials(s.paths.credentials);
+  if (existing && existing.box !== o.box && existing.revokedAt === void 0) {
+    throw new CliError(
+      `this machine is joined to ${existing.box} already; a machine joins one box only (run \`agentbox node leave\` first)`
+    );
+  }
+  const rejoin = existing && existing.box === o.box && existing.revokedAt === void 0 ? existing : null;
+  if (!SUPPORTED_PLATFORMS.has(s.platform)) throw new CliError(`machines on ${s.platform} are not supported yet (Linux only, for now)`);
+  try {
+    ensurePrivateDir(s.paths.dir);
+    fs15.accessSync(s.paths.dir, fs15.constants.W_OK);
+  } catch (err) {
+    throw new CliError(`the node folder ${s.paths.dir} is not writable: ${err.message}`);
+  }
+  const free = s.freeBytes(s.paths.dir);
+  if (free !== null && free < MIN_FREE_BYTES) {
+    throw new CliError(`${s.paths.dir} has ${Math.floor(free / 2 ** 20)} MiB free; the node needs ${MIN_FREE_BYTES / 2 ** 20} MiB`);
+  }
+  await s.install();
+  const presence = await s.enrol(await s.passphrase());
+  let started;
+  try {
+    started = await s.client.json("POST", "/_gate/node/join/start", {
+      auth: false,
+      body: {
+        json: {
+          name: o.name,
+          platform: s.platform,
+          arch: s.arch,
+          hostname: s.hostname,
+          ...rejoin ? { rejoin: { machineId: rejoin.machineId, token: rejoin.token } } : {}
+        }
+      },
+      what: "asking the box to join"
+    });
+  } catch (err) {
+    if (err.status === 404) throw new CliError(`${o.box} does not have machines turned on (or is not an agentbox)`, EXIT.NOT_FOUND);
+    throw err;
+  }
+  s.err(`
+${rejoin ? "Re-joining" : "Joining"} as "${started.name}". On the box's machines Admin page${started.approveAt ? ` (${started.approveAt})` : ""},
+`);
+  s.err(`check the name, platform and address, and type this code:
+
+    ${started.userCode}
+
+`);
+  s.err(`Waiting for approval (the code lasts ${Math.round(started.expiresIn / 60)} minutes)\u2026
+`);
+  const deadline = s.now() + started.expiresIn * 1e3;
+  let got = null;
+  while (got === null) {
+    await s.sleep(Math.max(1, started.interval) * 1e3);
+    if (s.now() > deadline) throw new CliError("the code expired before it was approved; run `agentbox node join` again");
+    let p;
+    try {
+      p = await s.client.json("POST", "/_gate/node/join/poll", { auth: false, body: { json: { joinCode: started.joinCode } }, what: "waiting for approval" });
+    } catch (err) {
+      if (err instanceof CliError && (err.exitCode === EXIT.UNREACHABLE || err.status === 429 || (err.status ?? 0) >= 500)) continue;
+      throw err;
+    }
+    if (p.status === "pending") continue;
+    if (p.status === "denied") throw new CliError("the join was denied on the box");
+    if (p.status === "expired") throw new CliError("the code expired, or was already used; run `agentbox node join` again");
+    got = p;
+  }
+  const credentials = {
+    version: 1,
+    box: o.box,
+    machineId: got.machineId,
+    name: got.name,
+    token: got.token,
+    presence,
+    joinedAt: s.now()
+  };
+  writeCredentials(s.paths.credentials, credentials);
+  s.err(`Joined as "${got.name}" (machine ${got.machineId}).
+`);
+  if (fs15.existsSync(s.paths.policy)) {
+    s.err(`Keeping the existing ${s.paths.policy}:
+`);
+  } else {
+    const folders = o.folders ?? await s.askFolders();
+    writeInitialPolicy(s.paths.policy, folders);
+    s.err(`Wrote ${s.paths.policy}:
+`);
+  }
+  s.printPolicy();
+  if (s.service) {
+    await s.service();
+    s.err("Waiting for the machine to show online\u2026\n");
+    if (await s.waitOnline()) s.err("Online.\n");
+    else s.err("It has not come online yet; see `agentbox node status` and `agentbox node logs`.\n");
+  } else {
+    s.err("Start it with `agentbox node run` (no service was registered).\n");
+  }
+  return credentials;
+}
+
+// src/node/link.ts
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { EventEmitter } from "node:events";
+function backoffMs(n, min, max, random = Math.random) {
+  const base = Math.min(max, min * 2 ** Math.max(0, n - 1));
+  return Math.round(base / 2 + base / 2 * random());
+}
+var NodeLink = class extends EventEmitter {
+  ws = null;
+  stateNow = "stopped";
+  running = false;
+  paused = false;
+  failures = 0;
+  failingSince = null;
+  retryTimer = null;
+  wakeTimer = null;
+  lastTick = 0;
+  nonce = "";
+  nextDelay = null;
+  o;
+  constructor(opts) {
+    super();
+    this.o = {
+      now: Date.now,
+      random: Math.random,
+      pingMs: PING_MS,
+      minBackoffMs: 1e3,
+      maxBackoffMs: 6e4,
+      slowAfterMs: 60 * 6e4,
+      slowRetryMs: 60 * 6e4,
+      duplicateBackoffMs: DUPLICATE_BACKOFF_MS,
+      wakeCheckMs: 5e3,
+      wakeJumpMs: 15e3,
+      ...opts
+    };
+  }
+  get state() {
+    return this.stateNow;
+  }
+  set(state) {
+    if (state === this.stateNow) return;
+    this.stateNow = state;
+    this.emit("state", state);
+  }
+  log(line) {
+    this.emit("log", line);
+  }
+  start() {
+    if (this.running) return;
+    this.running = true;
+    this.lastTick = this.o.now();
+    this.wakeTimer = setInterval(() => this.tick(), this.o.wakeCheckMs);
+    this.wakeTimer.unref();
+    if (!this.paused) this.connect();
+    else this.set("paused");
+  }
+  stop(state = "stopped") {
+    this.running = false;
+    if (this.wakeTimer) clearInterval(this.wakeTimer);
+    this.wakeTimer = null;
+    this.clearRetry();
+    const ws = this.ws;
+    this.ws = null;
+    ws?.close(1e3, "stopping");
+    this.set(state);
+  }
+  /** `agentbox node pause`: say so, close, and stay closed until resume. */
+  pause() {
+    this.paused = true;
+    this.clearRetry();
+    const ws = this.ws;
+    this.ws = null;
+    if (ws && ws.readyState === import_websocket.default.OPEN) {
+      ws.send(encodeControl({ type: "pause" }));
+      ws.close(1e3, "paused");
+    } else {
+      ws?.terminate();
+    }
+    if (this.running) this.set("paused");
+  }
+  resume() {
+    if (!this.paused) return;
+    this.paused = false;
+    this.failures = 0;
+    this.failingSince = null;
+    if (this.running && !this.ws) this.connect();
+  }
+  get isPaused() {
+    return this.paused;
+  }
+  sendPolicy(policy) {
+    if (this.stateNow === "online" && this.ws?.readyState === import_websocket.default.OPEN) this.ws.send(encodeControl({ type: "policy", policy }));
+  }
+  /** Tell the box this machine is leaving; resolves whether it was told. */
+  leave(timeoutMs = 5e3) {
+    const ws = this.ws;
+    if (!ws || this.stateNow !== "online" || ws.readyState !== import_websocket.default.OPEN) return Promise.resolve(false);
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => resolve(false), timeoutMs);
+      ws.once("close", (code2) => {
+        clearTimeout(timer);
+        resolve(code2 === 4005);
+      });
+      ws.send(encodeControl({ type: "leave" }));
+    });
+  }
+  clearRetry() {
+    if (this.retryTimer) clearTimeout(this.retryTimer);
+    this.retryTimer = null;
+  }
+  /** The wall clock jumped: the machine slept. Whatever was waiting, go now. */
+  tick() {
+    const t2 = this.o.now();
+    const late = t2 - this.lastTick - this.o.wakeCheckMs;
+    this.lastTick = t2;
+    if (late < this.o.wakeJumpMs || !this.running || this.paused) return;
+    if (this.stateNow === "revoked" || this.stateNow === "left") return;
+    this.log(`woke after ${Math.round(late / 1e3)} s; reconnecting now`);
+    this.failures = 0;
+    if (this.ws) {
+      const ws = this.ws;
+      this.ws = null;
+      ws.terminate();
+    }
+    this.clearRetry();
+    this.connect();
+  }
+  retry() {
+    if (!this.running || this.paused) return;
+    const t2 = this.o.now();
+    let delay;
+    if (this.nextDelay !== null) {
+      delay = this.nextDelay;
+      this.nextDelay = null;
+    } else {
+      this.failures += 1;
+      this.failingSince ??= t2;
+      delay = t2 - this.failingSince >= this.o.slowAfterMs ? this.o.slowRetryMs : backoffMs(this.failures, this.o.minBackoffMs, this.o.maxBackoffMs, this.o.random);
+    }
+    this.clearRetry();
+    this.retryTimer = setTimeout(() => {
+      this.retryTimer = null;
+      this.connect();
+    }, delay);
+    this.retryTimer.unref();
+  }
+  connect() {
+    if (!this.running || this.paused || this.ws) return;
+    this.set("connecting");
+    const url = `${this.o.box.replace(/^http/, "ws")}${LINK_PATH}`;
+    const ws = new import_websocket.default(url, { headers: { authorization: `Bearer ${this.o.token}` }, perMessageDeflate: false, handshakeTimeout: 2e4, followRedirects: false });
+    this.ws = ws;
+    let welcomed = false;
+    let stopKeepAlive = () => {
+    };
+    const streams = new StreamTable((f) => {
+      if (ws.readyState === import_websocket.default.OPEN) ws.send(f);
+    }, STREAM_WINDOW);
+    ws.on("unexpected-response", (_req, res) => {
+      this.log(`the box answered the link with HTTP ${res.statusCode}; retrying`);
+      res.resume();
+      ws.terminate();
+    });
+    ws.on("error", (err) => this.log(`link error: ${err.message}`));
+    ws.on("open", () => {
+      stopKeepAlive = keepAlive(
+        ws,
+        () => {
+          this.log("the box stopped answering pings; reconnecting");
+          ws.terminate();
+        },
+        this.o.pingMs
+      );
+      this.nonce = randomBytes5(32).toString("base64url");
+      void this.o.describe().then(
+        (d) => {
+          if (ws.readyState !== import_websocket.default.OPEN) return;
+          const hello = { type: "hello", protocol: PROTOCOL_VERSION, version: this.o.version, nonce: this.nonce, ...d };
+          ws.send(encodeControl(hello));
+        },
+        (err) => {
+          this.log(`could not describe this machine: ${err.message}`);
+          ws.terminate();
+        }
+      );
+    });
+    ws.on("message", (data, isBinary) => {
+      if (!isBinary) return;
+      let frame;
+      try {
+        frame = decodeFrame(data);
+      } catch {
+        this.log("the box sent a malformed frame; reconnecting");
+        ws.terminate();
+        return;
+      }
+      if (frame.type === FrameType.control) {
+        let m;
+        try {
+          m = decodeControl(frame.payload);
+        } catch {
+          return;
+        }
+        if (m.type === "ok") {
+          welcomed = true;
+          this.failures = 0;
+          this.failingSince = null;
+          this.set("online");
+          this.emit("welcome", { machineId: m.machineId, name: m.name });
+        } else if (m.type === "revoked") {
+          if (verifyRevoke(this.o.token, this.o.machineId, this.nonce, m.mac)) {
+            this.log("the box revoked this machine");
+            this.emit("revoked");
+            this.stop("revoked");
+          } else {
+            this.log("ignored a revoked message that was not signed for this machine and link");
+            ws.terminate();
+          }
+        } else if (m.type === "duplicate") {
+          this.log("the box refused this link: this machine is already linked from elsewhere; waiting 5 minutes");
+          this.set("duplicate");
+          this.nextDelay = this.o.duplicateBackoffMs;
+        } else if (m.type === "upgrade") {
+          this.log(`the box needs a newer node (protocol ${String(m.minimum)}); waiting an hour`);
+          this.set("upgrade");
+          this.nextDelay = this.o.slowRetryMs;
+          this.emit("upgrade", { minimum: m.minimum });
+        } else if (welcomed) {
+          this.emit("control", m);
+        }
+        return;
+      }
+      if (frame.type === FrameType.open) {
+        if (!welcomed || this.listenerCount("stream") === 0 || streams.has(frame.stream)) {
+          ws.send(encodeFrame(FrameType.close, frame.stream));
+          return;
+        }
+        this.emit("stream", streams.open(frame.stream), decodeOpen(frame.payload));
+        return;
+      }
+      if (!streams.receive(frame) && frame.type !== FrameType.close) ws.send(encodeFrame(FrameType.close, frame.stream));
+    });
+    ws.on("close", (code2) => {
+      stopKeepAlive();
+      streams.endAll("the link closed");
+      if (this.ws !== ws) return;
+      this.ws = null;
+      if (!this.running || this.stateNow === "revoked") return;
+      if (code2 === 4005) {
+        this.stop("left");
+        return;
+      }
+      if (welcomed) {
+        this.failures = 0;
+        this.failingSince = null;
+      }
+      if (this.stateNow !== "duplicate" && this.stateNow !== "upgrade") this.set("offline");
+      this.retry();
+    });
+  }
+};
+
+// src/node/presence.ts
+import { createHmac as createHmac2, pbkdf2, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+var PRESENCE_ITERATIONS = 6e5;
+var MIN_PASSPHRASE_LENGTH = 12;
+function derive(passphrase2, salt, iterations = PRESENCE_ITERATIONS) {
+  return new Promise((resolve, reject) => pbkdf2(passphrase2, salt, iterations, 32, "sha256", (err, key) => err ? reject(err) : resolve(key)));
+}
+async function enrol(passphrase2, now, iterations = PRESENCE_ITERATIONS) {
+  const salt = randomBytes6(16);
+  const key = await derive(passphrase2, salt, iterations);
+  return { algorithm: "PBKDF2-SHA256", iterations, salt: salt.toString("base64url"), key: key.toString("base64url"), createdAt: now };
+}
+async function askPassphrase(prompt, err) {
+  err("The machines passphrase (the one set on the box's host with `agentbox machines enable`).\n");
+  err("This machine keeps only a key derived from it; the box never sees it from here.\n");
+  const pass = await prompt.secret("Machines passphrase: ");
+  if (pass.length < MIN_PASSPHRASE_LENGTH) throw new CliError(`the machines passphrase has at least ${MIN_PASSPHRASE_LENGTH} characters`);
+  const again = await prompt.secret("Again: ");
+  if (again !== pass) throw new CliError("the passphrases did not match");
+  return pass;
+}
+var CHALLENGE_MS = 6e4;
+var GRANT_IDLE_MS = 30 * 6e4;
+var LOCK_FAILURES = 5;
+var LOCK_WINDOW_MS = 10 * 6e4;
+var LOCK_MS = 15 * 6e4;
+var MAX_CHALLENGES = 64;
+var MAX_GRANTS = 32;
+function presenceMessage(challenge, sessionId, machineId) {
+  return Buffer.concat([challenge, Buffer.from(sessionId, "utf8"), Buffer.from(machineId, "utf8")]);
+}
+function presenceAnswer(key, challenge, sessionId, machineId) {
+  return createHmac2("sha256", key).update(presenceMessage(challenge, sessionId, machineId)).digest("base64url");
+}
+var PresenceGate = class {
+  constructor(o) {
+    this.o = o;
+    this.key = Buffer.from(o.presence.key, "base64url");
+    this.now = o.now ?? Date.now;
+  }
+  o;
+  key;
+  challenges = /* @__PURE__ */ new Map();
+  grants = /* @__PURE__ */ new Map();
+  failures = [];
+  lockedUntil = 0;
+  now;
+  /** Locked until this time, or `null`. */
+  locked() {
+    return this.lockedUntil > this.now() ? this.lockedUntil : null;
+  }
+  challenge(session) {
+    if (session === null) return null;
+    const until = this.locked();
+    if (until !== null) return { locked: true, until };
+    const t2 = this.now();
+    for (const [c, v] of this.challenges) if (v.expiresAt <= t2) this.challenges.delete(c);
+    while (this.challenges.size >= MAX_CHALLENGES) this.challenges.delete(this.challenges.keys().next().value);
+    const challenge = randomBytes6(32).toString("base64url");
+    const expiresAt = t2 + CHALLENGE_MS;
+    this.challenges.set(challenge, { session, expiresAt });
+    return { challenge, salt: this.o.presence.salt, iterations: this.o.presence.iterations, expiresAt };
+  }
+  answer(session, challenge, answer) {
+    if (session === null) return { ok: false, error: "no_session" };
+    const until = this.locked();
+    if (until !== null) return { ok: false, error: "locked", until };
+    const t2 = this.now();
+    const c = this.challenges.get(challenge);
+    this.challenges.delete(challenge);
+    if (!c || c.expiresAt <= t2 || c.session !== session) return { ok: false, error: "expired" };
+    const want = Buffer.from(presenceAnswer(this.key, Buffer.from(challenge, "base64url"), session, this.o.machineId), "base64url");
+    const got = Buffer.from(answer, "base64url");
+    if (got.length !== want.length || !timingSafeEqual3(got, want)) {
+      this.failures = this.failures.filter((f) => f > t2 - LOCK_WINDOW_MS);
+      this.failures.push(t2);
+      if (this.failures.length >= LOCK_FAILURES) {
+        this.lockedUntil = t2 + LOCK_MS;
+        this.failures = [];
+        this.challenges.clear();
+        this.o.log?.(`presence: ${LOCK_FAILURES} wrong machines passphrases in ${LOCK_WINDOW_MS / 6e4} minutes; locked for ${LOCK_MS / 6e4} minutes`);
+        return { ok: false, error: "locked", until: this.lockedUntil };
+      }
+      return { ok: false, error: "wrong", failures: this.failures.length };
+    }
+    this.failures = [];
+    while (this.grants.size >= MAX_GRANTS) this.grants.delete(this.grants.keys().next().value);
+    const grant = `pg_${randomBytes6(32).toString("base64url")}`;
+    const g = { session, issuedAt: t2, lastActive: t2, open: 0 };
+    this.grants.set(grant, g);
+    return { ok: true, grant, expiresAt: this.expiry(g) };
+  }
+  expiry(g) {
+    return g.issuedAt + this.o.hours() * 60 * 6e4;
+  }
+  /** Whether `grant` is live for `session` now. */
+  check(grant, session) {
+    if (grant === null || session === null) return false;
+    const g = this.grants.get(grant);
+    if (!g || g.session !== session) return false;
+    const t2 = this.now();
+    if (t2 >= this.expiry(g) || g.open === 0 && t2 - g.lastActive >= GRANT_IDLE_MS) {
+      this.grants.delete(grant);
+      return false;
+    }
+    return true;
+  }
+  /** A channel opened on `grant`: it does not idle out while open. Returns its release. */
+  hold(grant) {
+    const g = this.grants.get(grant);
+    if (!g) return () => {
+    };
+    g.open += 1;
+    g.lastActive = this.now();
+    let done = false;
+    return () => {
+      if (done) return;
+      done = true;
+      g.open -= 1;
+      g.lastActive = this.now();
+    };
+  }
+};
+
+// src/node/prompt.ts
+var Prompter = class {
+  constructor(stdin, out) {
+    this.stdin = stdin;
+    this.out = out;
+  }
+  stdin;
+  out;
+  buffer = "";
+  ended = false;
+  waiting = null;
+  listening = false;
+  listen() {
+    if (this.listening) return;
+    this.listening = true;
+    this.stdin.on("data", (c) => {
+      this.buffer += c.toString();
+      this.waiting?.();
+    });
+    this.stdin.on("end", () => {
+      this.ended = true;
+      this.waiting?.();
+    });
+    this.stdin.resume();
+  }
+  async nextLine() {
+    this.listen();
+    for (; ; ) {
+      const i = this.buffer.search(/\r?\n|\r/);
+      if (i >= 0) {
+        const line = this.buffer.slice(0, i);
+        const nl = /^\r?\n|^\r/.exec(this.buffer.slice(i))?.[0].length ?? 1;
+        this.buffer = this.buffer.slice(i + nl);
+        return line;
+      }
+      if (this.ended) {
+        if (this.buffer === "") throw new CliError("no answer on stdin", EXIT.USAGE);
+        const line = this.buffer;
+        this.buffer = "";
+        return line;
+      }
+      await new Promise((r) => this.waiting = r);
+      this.waiting = null;
+    }
+  }
+  async line(question) {
+    this.out.write(question);
+    return (await this.nextLine()).trim();
+  }
+  /** A secret: on a terminal, read in raw mode and never echoed. */
+  async secret(question) {
+    this.out.write(question);
+    if (!this.stdin.isTTY || !this.stdin.setRawMode) return this.nextLine();
+    this.listen();
+    this.stdin.setRawMode(true);
+    try {
+      let value = "";
+      for (; ; ) {
+        while (this.buffer.length > 0) {
+          const ch = this.buffer[0];
+          this.buffer = this.buffer.slice(1);
+          if (ch === "\r" || ch === "\n") {
+            this.out.write("\n");
+            return value;
+          }
+          if (ch === "") throw new CliError("interrupted", EXIT.INTERRUPTED);
+          if (ch === "\x7F" || ch === "\b") value = value.slice(0, -1);
+          else if (ch >= " ") value += ch;
+        }
+        if (this.ended) throw new CliError("no answer", EXIT.USAGE);
+        await new Promise((r) => this.waiting = r);
+        this.waiting = null;
+      }
+    } finally {
+      this.stdin.setRawMode(false);
+    }
+  }
+  close() {
+    this.stdin.pause();
+  }
+};
+
+// src/node/run.ts
+import fs19 from "node:fs";
+import path17 from "node:path";
+
+// ../hostcore/src/herdr/socket.ts
+import net4 from "node:net";
+import readline from "node:readline";
+var HerdrError = class extends Error {
+  code;
+  constructor(code2, message) {
+    super(message);
+    this.code = code2;
+    this.name = "HerdrError";
+  }
+};
+var seq = 0;
+function request(socketPath, method, params = {}, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const id = `wb_${++seq}`;
+    const sock = net4.connect(socketPath);
+    const rl = readline.createInterface({ input: sock });
+    rl.on("error", () => {
+    });
+    const timer = setTimeout(() => {
+      rl.close();
+      sock.destroy();
+      reject(new HerdrError("timeout", `${method} timed out`));
+    }, opts.timeoutMs ?? 1e4);
+    sock.once("error", (err) => {
+      clearTimeout(timer);
+      rl.close();
+      reject(err);
+    });
+    sock.once("connect", () => {
+      sock.write(JSON.stringify({ id, method, params }) + "\n");
+    });
+    rl.once("line", (line) => {
+      clearTimeout(timer);
+      rl.close();
+      sock.end();
+      let msg;
+      try {
+        msg = JSON.parse(line);
+      } catch {
+        reject(new HerdrError("bad_json", line.slice(0, 200)));
+        return;
+      }
+      if (msg.error) {
+        reject(new HerdrError(msg.error.code ?? "error", msg.error.message ?? "herdr error"));
+        return;
+      }
+      resolve(msg.result);
+    });
+  });
+}
+function subscribe(socketPath, subscriptions, onEvent, onClose) {
+  return new Promise((resolve, reject) => {
+    const sock = net4.connect(socketPath);
+    let started = false;
+    let closing = false;
+    const rl = readline.createInterface({ input: sock });
+    rl.on("error", () => {
+    });
+    sock.once("connect", () => {
+      sock.write(JSON.stringify({ id: "sub", method: "events.subscribe", params: { subscriptions } }) + "\n");
+    });
+    sock.on("error", (err) => {
+      if (!started) {
+        reject(err);
+      } else if (!closing) {
+        onClose(err);
+      }
+    });
+    sock.on("close", () => {
+      if (started && !closing) onClose();
+    });
+    rl.on("line", (line) => {
+      let msg;
+      try {
+        msg = JSON.parse(line);
+      } catch {
+        return;
+      }
+      if (!started) {
+        if (msg.error) {
+          sock.destroy();
+          reject(new HerdrError(msg.error.code ?? "error", msg.error.message ?? "herdr error"));
+          return;
+        }
+        started = true;
+        resolve({
+          close: () => {
+            closing = true;
+            sock.destroy();
+          }
+        });
+        return;
+      }
+      if (msg.event) onEvent(msg);
+    });
+  });
+}
+
+// ../hostcore/src/herdr/session.ts
+var LIFECYCLE_TYPES = [
+  "workspace.created",
+  "workspace.updated",
+  "workspace.metadata_updated",
+  "workspace.renamed",
+  "workspace.moved",
+  "workspace.reordered",
+  "workspace.closed",
+  "workspace.focused",
+  "worktree.created",
+  "worktree.opened",
+  "worktree.removed",
+  "tab.created",
+  "tab.closed",
+  "tab.focused",
+  "tab.renamed",
+  "tab.moved",
+  "pane.created",
+  "pane.closed",
+  "pane.updated",
+  "pane.focused",
+  "pane.moved",
+  "pane.exited",
+  "pane.agent_detected",
+  "layout.updated"
+];
+var SessionHub = class {
+  socketPath;
+  lifecycleSub = null;
+  agentSub = null;
+  panes = /* @__PURE__ */ new Set();
+  listeners = /* @__PURE__ */ new Set();
+  _connected = false;
+  _version = null;
+  _protocol = null;
+  stopped = false;
+  reconnecting = false;
+  reconnectDelay = 250;
+  reconnectTimer = null;
+  agentDebounce = null;
+  constructor(socketPath) {
+    this.socketPath = socketPath;
+  }
+  get connected() {
+    return this._connected;
+  }
+  get version() {
+    return this._version;
+  }
+  get protocol() {
+    return this._protocol;
+  }
+  paneIds() {
+    return [...this.panes];
+  }
+  on(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  emit(m) {
+    for (const listener of this.listeners) listener(m);
+  }
+  async start() {
+    await this.connect();
+  }
+  async snapshot() {
+    const res = await request(this.socketPath, "session.snapshot");
+    return res.snapshot;
+  }
+  stop() {
+    this.stopped = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.agentDebounce) {
+      clearTimeout(this.agentDebounce);
+      this.agentDebounce = null;
+    }
+    this.closeSubs();
+    this._connected = false;
+    this.listeners.clear();
+  }
+  closeSubs() {
+    if (this.lifecycleSub) {
+      this.lifecycleSub.close();
+      this.lifecycleSub = null;
+    }
+    if (this.agentSub) {
+      this.agentSub.close();
+      this.agentSub = null;
+    }
+  }
+  /** Open lifecycle subscription, load the snapshot, then open agent-status. */
+  async connect() {
+    if (this.agentDebounce) {
+      clearTimeout(this.agentDebounce);
+      this.agentDebounce = null;
+    }
+    this.closeSubs();
+    this.lifecycleSub = await subscribe(
+      this.socketPath,
+      LIFECYCLE_TYPES.map((type) => ({ type })),
+      (e) => this.onLifecycle(e),
+      () => this.onDrop()
+    );
+    const snap = await this.snapshot();
+    this._version = snap.version;
+    this._protocol = snap.protocol;
+    this.panes.clear();
+    for (const p of snap.panes) this.panes.add(p.pane_id);
+    await this.openAgentSub();
+    this._connected = true;
+  }
+  async openAgentSub() {
+    const subs = this.paneIds().map((pane_id) => ({
+      type: "pane.agent_status_changed",
+      pane_id
+    }));
+    const next = await subscribe(
+      this.socketPath,
+      subs,
+      (e) => this.onAgentEvent(e),
+      () => this.onDrop()
+    );
+    const previous = this.agentSub;
+    this.agentSub = next;
+    if (previous) previous.close();
+  }
+  onLifecycle(e) {
+    this.emit({ kind: "event", event: e.event, data: e.data });
+    let changed = false;
+    if (e.event === "pane_created" || e.event === "pane_moved") {
+      const paneId = e.data.pane?.pane_id;
+      if (paneId && !this.panes.has(paneId)) {
+        this.panes.add(paneId);
+        changed = true;
+      }
+    } else if (e.event === "pane_closed") {
+      const paneId = e.data.pane_id;
+      if (paneId && this.panes.delete(paneId)) changed = true;
+    }
+    if (changed) this.scheduleAgentReopen();
+  }
+  onAgentEvent(e) {
+    this.emit({ kind: "event", event: "pane_agent_status_changed", data: e.data });
+  }
+  scheduleAgentReopen() {
+    if (this.agentDebounce) clearTimeout(this.agentDebounce);
+    this.agentDebounce = setTimeout(() => {
+      this.agentDebounce = null;
+      this.openAgentSub().catch(() => this.onDrop());
+    }, 50);
+  }
+  onDrop() {
+    if (this.stopped || this.reconnecting) return;
+    this.reconnecting = true;
+    this._connected = false;
+    this.scheduleReconnect();
+  }
+  scheduleReconnect() {
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      if (this.stopped) return;
+      this.connect().then(
+        () => {
+          this.reconnectDelay = 250;
+          this.reconnecting = false;
+          this.emit({ kind: "reset", reason: "herdr reconnected" });
+        },
+        () => {
+          this.reconnectDelay = Math.min(this.reconnectDelay * 2, 5e3);
+          this.scheduleReconnect();
+        }
+      );
+    }, this.reconnectDelay);
+  }
+};
+
+// ../hostcore/src/herdr/terminal.ts
+import { spawn as spawn5 } from "node:child_process";
+import readline2 from "node:readline";
+var MAX_REPLAY_BYTES = 1e6;
+var RELEASE_GRACE_MS = 1e3;
+var SIGKILL_GRACE_MS = 2e3;
+function killWithFallback(child, exited, graceMs = SIGKILL_GRACE_MS) {
+  if (exited()) return null;
+  if (!child.killed) child.kill("SIGTERM");
+  const timer = setTimeout(() => {
+    if (!exited()) child.kill("SIGKILL");
+  }, graceMs);
+  timer.unref?.();
+  return timer;
+}
+var PaneStream = class {
+  constructor(paneId, env, cols, rows, onDead) {
+    this.paneId = paneId;
+    this.env = env;
+    this.onDead = onDead;
+    this.cols = cols;
+    this.rows = rows;
+    this.watchScroll();
+    this.child = this.spawn();
+  }
+  paneId;
+  env;
+  onDead;
+  child;
+  viewers = /* @__PURE__ */ new Set();
+  /** Last full frame; the baseline replayed to late joiners. */
+  full = null;
+  /** Diffs received since the last full frame, replayed after it. */
+  diffs = [];
+  diffBytes = 0;
+  cols;
+  rows;
+  /** Last size each viewer asked for, so focus can restore that viewer's size. */
+  viewerSize = /* @__PURE__ */ new WeakMap();
+  lastFullSeq = 0;
+  released = false;
+  dead = false;
+  /** True once the child process has actually exited (not merely signalled). */
+  childExited = false;
+  killTimer = null;
+  /** Where herdr's scrollback stands, from its pane.scroll_changed events. */
+  scrolled = null;
+  scrollSub = null;
+  /**
+   * Follow herdr's scrollback position for this pane and pass it to every
+   * viewer, for the scrollbar and the way back to live. herdr reports it on a
+   * scroll, on output that grows the history, and when typing snaps the pane
+   * back to live. Without the socket the pane still scrolls, just unmarked.
+   */
+  watchScroll() {
+    const socketPath = this.env.HERDR_SOCKET_PATH;
+    if (!socketPath) return;
+    subscribe(
+      socketPath,
+      [{ type: "pane.scroll_changed", pane_id: this.paneId }],
+      (e) => {
+        const info = e.data?.scroll;
+        if (!info) return;
+        const m = { type: "scrolled", offset: info.offset_from_bottom, max: info.max_offset_from_bottom, rows: info.viewport_rows };
+        this.scrolled = m;
+        for (const v of this.viewers) v.sendJson(m);
+      },
+      () => {
+      }
+    ).then(
+      (sub) => {
+        if (this.dead || this.released) sub.close();
+        else this.scrollSub = sub;
+      },
+      () => {
+      }
+    );
+  }
+  unwatchScroll() {
+    this.scrollSub?.close();
+    this.scrollSub = null;
+  }
+  /** True once the child has exited/errored or herdr reported the pane closed. */
+  get isDead() {
+    return this.dead;
+  }
+  spawn() {
+    const child = spawn5(
+      "herdr",
+      [
+        "terminal",
+        "session",
+        "control",
+        this.paneId,
+        "--takeover",
+        "--cols",
+        String(this.cols),
+        "--rows",
+        String(this.rows)
+      ],
+      { env: this.env, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    if (child.stdout) {
+      readline2.createInterface({ input: child.stdout }).on("line", (line) => this.onLine(line));
+    }
+    child.stderr?.resume();
+    child.on("error", () => this.markDead("stream error"));
+    child.on("exit", () => {
+      this.childExited = true;
+      if (this.killTimer) {
+        clearTimeout(this.killTimer);
+        this.killTimer = null;
+      }
+      this.markDead("stream ended");
+    });
+    return child;
+  }
+  /**
+   * Send SIGTERM and, if the child is still alive after a bounded grace, follow
+   * it with SIGKILL. A herdr controller that ignores SIGTERM would otherwise
+   * keep the process — and this stream — from ever tearing down.
+   */
+  killWithFallback() {
+    if (this.childExited || this.killTimer) return;
+    this.killTimer = killWithFallback(this.child, () => this.childExited);
+  }
+  /**
+   * Mark the stream dead exactly once (dropping it from the registry) and close
+   * any remaining viewers. Called on child exit/error and on terminal.closed.
+   */
+  markDead(reason) {
+    this.unwatchScroll();
+    if (!this.dead) {
+      this.dead = true;
+      this.onDead(this.paneId, this);
+    }
+    this.shutdownViewers(reason);
+  }
+  shutdownViewers(reason) {
+    for (const v of this.viewers) v.close(reason);
+    this.viewers.clear();
+  }
+  onLine(line) {
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (msg.type === "terminal.frame") {
+      const buf = Buffer.from(msg.bytes, "base64");
+      if (msg.full) {
+        this.full = buf;
+        this.diffs = [];
+        this.diffBytes = 0;
+        this.lastFullSeq = msg.seq;
+      } else {
+        this.diffs.push(buf);
+        this.diffBytes += buf.length;
+        if (this.diffBytes > MAX_REPLAY_BYTES) {
+          this.full = null;
+          this.diffs = [];
+          this.diffBytes = 0;
+        }
+      }
+      for (const v of this.viewers) v.send(buf);
+    } else if (msg.type === "terminal.closed") {
+      this.markDead(msg.reason ?? "closed");
+    }
+  }
+  write(o) {
+    this.child.stdin?.write(JSON.stringify(o) + "\n");
+  }
+  addViewer(v, cols, rows) {
+    this.viewers.add(v);
+    this.viewerSize.set(v, { cols, rows });
+    if (this.scrolled) v.sendJson(this.scrolled);
+    if (this.full && this.diffBytes < MAX_REPLAY_BYTES && cols === this.cols && rows === this.rows) {
+      v.send(this.full);
+      for (const d of this.diffs) v.send(d);
+    } else {
+      this.resize(cols, rows);
+    }
+  }
+  removeViewer(v) {
+    if (!this.viewers.delete(v)) return;
+    if (this.viewers.size === 0) this.release();
+  }
+  release() {
+    if (this.released) return;
+    this.released = true;
+    this.unwatchScroll();
+    this.write({ type: "terminal.release" });
+    this.child.stdin?.end();
+    setTimeout(() => this.killWithFallback(), RELEASE_GRACE_MS).unref();
+  }
+  /** Kill the child immediately; used on shutdown, not on normal release. */
+  destroy() {
+    this.released = true;
+    this.unwatchScroll();
+    this.child.stdin?.end();
+    this.killWithFallback();
+  }
+  resize(cols, rows) {
+    this.cols = cols;
+    this.rows = rows;
+    this.write({ type: "terminal.resize", cols, rows });
+    for (const v of this.viewers) v.sendJson({ type: "size", cols, rows });
+  }
+  /** Record this viewer's size and make it the current pane size. */
+  resizeFor(v, cols, rows) {
+    this.viewerSize.set(v, { cols, rows });
+    this.resize(cols, rows);
+  }
+  /** The focusing viewer becomes the size owner: restore its last known size. */
+  focus(v) {
+    const size = this.viewerSize.get(v) ?? { cols: this.cols, rows: this.rows };
+    this.resize(size.cols, size.rows);
+  }
+  input(text, bytes) {
+    this.write({ type: "terminal.input", ...bytes ? { bytes } : { text: text ?? "" } });
+  }
+  scroll(direction, lines) {
+    this.write({ type: "terminal.scroll", direction, lines: Math.max(1, lines | 0), source: "wheel" });
+  }
+  /** Put herdr's view of the pane `offset` lines above live; 0 is back to live. */
+  scrollTo(offset) {
+    const socketPath = this.env.HERDR_SOCKET_PATH;
+    if (!socketPath || !Number.isFinite(offset)) return;
+    const offset_from_bottom = Math.max(0, Math.floor(offset));
+    request(socketPath, "pane.scroll", { pane_id: this.paneId, offset_from_bottom }).catch(() => {
+    });
+  }
+  size() {
+    return { cols: this.cols, rows: this.rows };
+  }
+  get viewerCount() {
+    return this.viewers.size;
+  }
+};
+var TerminalStreams = class {
+  constructor(env) {
+    this.env = env;
+  }
+  env;
+  streams = /* @__PURE__ */ new Map();
+  /** Drop a stream from the registry, but only if it is still the live one. */
+  forget(paneId, stream) {
+    if (this.streams.get(paneId) === stream) this.streams.delete(paneId);
+  }
+  attach(paneId, viewer, cols = 80, rows = 24) {
+    let stream = this.streams.get(paneId);
+    if (!stream || stream.isDead) {
+      stream = new PaneStream(paneId, this.env, cols, rows, (p, s2) => this.forget(p, s2));
+      this.streams.set(paneId, stream);
+    }
+    stream.addViewer(viewer, cols, rows);
+    const s = stream;
+    let detached = false;
+    return {
+      input: (text, bytes) => s.input(text, bytes),
+      resize: (c, r) => s.resizeFor(viewer, c, r),
+      scroll: (direction, lines) => s.scroll(direction, lines),
+      scrollTo: (offset) => s.scrollTo(offset),
+      focus: () => s.focus(viewer),
+      detach: () => {
+        if (detached) return;
+        detached = true;
+        s.removeViewer(viewer);
+        if (s.viewerCount === 0) this.forget(paneId, s);
+      }
+    };
+  }
+  active(paneId) {
+    return this.streams.has(paneId);
+  }
+  size(paneId) {
+    return this.streams.get(paneId)?.size() ?? null;
+  }
+  lastFullSeq(paneId) {
+    return this.streams.get(paneId)?.lastFullSeq ?? 0;
+  }
+  /** Test-only: number of live pane streams in the registry. */
+  streamCount() {
+    return this.streams.size;
+  }
+  /** Tear down every live stream; call on server shutdown. */
+  stop() {
+    for (const s of this.streams.values()) s.destroy();
+    this.streams.clear();
+  }
+};
+
+// ../hostcore/src/ws-heartbeat.ts
+var HEARTBEAT_MS = 3e4;
+function heartbeat(socket2, intervalMs = HEARTBEAT_MS) {
+  let alive = true;
+  socket2.on("pong", () => {
+    alive = true;
+  });
+  const timer = setInterval(() => {
+    if (socket2.readyState !== socket2.OPEN) return;
+    if (!alive) {
+      socket2.terminate();
+      return;
+    }
+    alive = false;
+    try {
+      socket2.ping();
+    } catch {
+    }
+  }, intervalMs);
+  timer.unref?.();
+  const stop = () => clearInterval(timer);
+  socket2.on("close", stop);
+  return stop;
+}
+
+// ../hostcore/src/herdr/terminal-socket.ts
+var PANE_RE = /^w[0-9A-Za-z]{1,12}:p[0-9A-Za-z]{1,12}$/;
+var MAX_BUFFERED_BYTES = 8 * 1024 * 1024;
+var MAX_CHANNELS = 64;
+function isBackpressured(bufferedAmount, limit = MAX_BUFFERED_BYTES) {
+  return bufferedAmount > limit;
+}
+function clamp(value, min, max, fallback) {
+  return Number.isFinite(value) ? Math.min(max, Math.max(min, Math.trunc(value))) : fallback;
+}
+function muxFrame(ch, data) {
+  const out = Buffer.allocUnsafe(2 + data.length);
+  out.writeUInt16BE(ch, 0);
+  data.copy(out, 2);
+  return out;
+}
+function sendOrShed(socket2, data) {
+  if (socket2.readyState !== socket2.OPEN) return;
+  if (isBackpressured(socket2.bufferedAmount)) {
+    try {
+      socket2.close(1013, "viewer too slow");
+    } catch {
+    }
+    return;
+  }
+  socket2.send(data, { binary: true });
+}
+function sendJson(socket2, m) {
+  if (socket2.readyState === socket2.OPEN) socket2.send(JSON.stringify(m));
+}
+function control(a, msg, size) {
+  switch (msg.type) {
+    case "input":
+      a.input(msg.text, msg.bytes);
+      break;
+    case "resize":
+      a.resize(clamp(Number(msg.cols), 20, 500, size.cols), clamp(Number(msg.rows), 5, 200, size.rows));
+      break;
+    case "scroll":
+      if (msg.direction === "up" || msg.direction === "down") a.scroll(msg.direction, Number(msg.lines));
+      break;
+    case "scrollTo":
+      a.scrollTo(Number(msg.offset));
+      break;
+    case "focus":
+      a.focus();
+      break;
+    default:
+      break;
+  }
+}
+function parse(raw) {
+  try {
+    return JSON.parse(raw.toString());
+  } catch {
+    return null;
+  }
+}
+function single(socket2, streams, pane, cols, rows) {
+  const viewer = {
+    send: (data) => sendOrShed(socket2, data),
+    sendJson: (m) => sendJson(socket2, m),
+    close: (reason) => {
+      try {
+        if (socket2.readyState === socket2.OPEN) {
+          socket2.send(JSON.stringify({ type: "closed", reason }));
+          socket2.close(1e3);
+        }
+      } catch {
+      }
+    }
+  };
+  const attachment = streams.attach(pane, viewer, cols, rows);
+  socket2.on("message", (raw) => {
+    const msg = parse(raw);
+    if (msg) control(attachment, msg, { cols, rows });
+  });
+  socket2.on("close", () => attachment.detach());
+}
+function shared(socket2, streams) {
+  const channels = /* @__PURE__ */ new Map();
+  const notice = (ch, m) => sendJson(socket2, { ...m, ch });
+  const attach2 = (ch, pane, c, r) => {
+    if (channels.has(ch)) return;
+    if (typeof pane !== "string" || !PANE_RE.test(pane)) return notice(ch, { type: "closed", reason: "invalid pane" });
+    if (channels.size >= MAX_CHANNELS) return notice(ch, { type: "closed", reason: "too many panes on one socket" });
+    const size = { cols: clamp(Number(c), 20, 500, 80), rows: clamp(Number(r), 5, 200, 24) };
+    let live = true;
+    const viewer = {
+      send: (data) => {
+        if (live) sendOrShed(socket2, muxFrame(ch, data));
+      },
+      sendJson: (m) => {
+        if (live) notice(ch, m);
+      },
+      close: (reason) => {
+        if (!live) return;
+        live = false;
+        channels.delete(ch);
+        notice(ch, { type: "closed", reason });
+      }
+    };
+    const attachment = streams.attach(pane, viewer, size.cols, size.rows);
+    if (live) channels.set(ch, { attachment, size });
+  };
+  socket2.on("message", (raw) => {
+    const msg = parse(raw);
+    if (!msg) return;
+    const ch = Number(msg.ch);
+    if (!Number.isInteger(ch) || ch < 0 || ch > 65535) return;
+    if (msg.type === "ping") return sendJson(socket2, { type: "pong", ch, t: Number(msg.t) || 0 });
+    if (msg.type === "attach") return attach2(ch, msg.pane, msg.cols, msg.rows);
+    const c = channels.get(ch);
+    if (!c) return;
+    if (msg.type === "detach") {
+      channels.delete(ch);
+      c.attachment.detach();
+      return;
+    }
+    if (msg.type === "resize") c.size = { cols: clamp(Number(msg.cols), 20, 500, c.size.cols), rows: clamp(Number(msg.rows), 5, 200, c.size.rows) };
+    control(c.attachment, msg, c.size);
+  });
+  socket2.on("close", () => {
+    for (const c of channels.values()) c.attachment.detach();
+    channels.clear();
+  });
+}
+function serveTerminalSocket(socket2, streams, query) {
+  const pane = query.pane;
+  if (pane === void 0) {
+    heartbeat(socket2);
+    shared(socket2, streams);
+    return;
+  }
+  if (typeof pane !== "string" || !PANE_RE.test(pane)) {
+    socket2.close(1008, "invalid pane");
+    return;
+  }
+  heartbeat(socket2);
+  single(socket2, streams, pane, clamp(Number(query.cols), 20, 500, 80), clamp(Number(query.rows), 5, 200, 24));
+}
+
+// ../hostcore/src/rpc-allowlist.ts
+var EXACT = /* @__PURE__ */ new Set(["ping", "session.snapshot", "notification.show"]);
+var PREFIXES = ["workspace.", "worktree.", "tab.", "pane.", "agent.", "layout."];
+function isGraphics(method) {
+  return method === "pane.graphics" || method.startsWith("pane.graphics.");
+}
+function isAllowed(method) {
+  if (EXACT.has(method)) return true;
+  if (isGraphics(method)) return false;
+  return PREFIXES.some(
+    (p) => method.startsWith(p) && method.length > p.length && /^[a-z_.]+$/.test(method)
+  );
+}
+
+// src/node/herdr.ts
+import { spawn as spawn6 } from "node:child_process";
+import { randomBytes as randomBytes7 } from "node:crypto";
+import { EventEmitter as EventEmitter2 } from "node:events";
+import fs16 from "node:fs";
+import os8 from "node:os";
+import path14 from "node:path";
+var HERDR_SESSION = "agentbox-node";
+var CHECK_MS = 3e4;
+var FAILED_CHECKS = 2;
+var READY_MS = 15e3;
+var MAX_SOCKET_PATH = 96;
+var HerdrSupervisor = class extends EventEmitter2 {
+  constructor(o) {
+    super();
+    this.o = o;
+    this.stateFile = path14.join(o.dir, "state", "herdr.json");
+  }
+  o;
+  child = null;
+  socket = null;
+  pid = null;
+  stopped = false;
+  failures = 0;
+  checker = null;
+  restarting = null;
+  backoff = 1e3;
+  stateFile;
+  /** The control socket now, or `null` while herdr is starting. */
+  get socketPath() {
+    return this.socket;
+  }
+  log(line) {
+    this.emit("log", line);
+  }
+  async answers(socket2) {
+    try {
+      const pong = await request(socket2, "ping", {}, { timeoutMs: 5e3 });
+      return pong.version === (this.o.version ?? HERDR_VERSION);
+    } catch {
+      return false;
+    }
+  }
+  /** A fresh socket path: in the node folder when it fits, else a private folder of its own. */
+  freshSocket() {
+    const name = `herdr-${randomBytes7(4).toString("hex")}.sock`;
+    const inNode = path14.join(this.o.dir, name);
+    if (Buffer.byteLength(inNode) <= MAX_SOCKET_PATH) return inNode;
+    const dir = fs16.mkdtempSync(path14.join(os8.tmpdir(), "agentbox-node-"));
+    fs16.chmodSync(dir, 448);
+    return path14.join(dir, name);
+  }
+  async start() {
+    this.stopped = false;
+    const saved = this.readSaved();
+    if (saved && await this.answers(saved.socket)) {
+      this.socket = saved.socket;
+      this.pid = saved.pid;
+      this.log(`herdr: kept the running server (pid ${saved.pid})`);
+      this.emit("ready", saved.socket, { restored: false });
+    } else {
+      if (saved) this.kill(saved.pid);
+      await this.spawnServer();
+    }
+    this.watch();
+  }
+  readSaved() {
+    try {
+      const v = JSON.parse(fs16.readFileSync(this.stateFile, "utf8"));
+      return typeof v.socket === "string" && typeof v.pid === "number" ? { socket: v.socket, pid: v.pid } : null;
+    } catch {
+      return null;
+    }
+  }
+  /** Only a herdr of ours: on Linux its command line says so; elsewhere, the pid we recorded. */
+  kill(pid) {
+    try {
+      if (process.platform === "linux") {
+        const cmd = fs16.readFileSync(`/proc/${pid}/cmdline`, "utf8");
+        if (!cmd.includes("herdr")) return;
+      }
+      process.kill(pid, "SIGTERM");
+    } catch {
+    }
+  }
+  removeSocket(socket2) {
+    if (!socket2) return;
+    for (const f of [socket2, socket2.replace(/\.sock$/, "-client.sock")]) fs16.rmSync(f, { force: true });
+  }
+  async spawnServer() {
+    const old = this.socket;
+    this.socket = null;
+    this.removeSocket(old);
+    const socket2 = this.freshSocket();
+    ensurePrivateDir(path14.dirname(this.stateFile));
+    const child = spawn6(this.o.bin, ["server"], {
+      env: { ...this.o.env, HERDR_SOCKET_PATH: socket2, HERDR_SESSION },
+      stdio: ["ignore", "ignore", "pipe"],
+      // Its own session: herdr counts only such a server as a daemon, and it
+      // outlives the node.
+      detached: true,
+      windowsHide: true
+    });
+    this.child = child;
+    child.stderr?.on("data", (c) => this.log(`herdr: ${c.toString("utf8").trim().slice(0, 500)}`));
+    child.once("error", (err) => this.log(`herdr: could not start: ${err.message}`));
+    child.once("exit", (code2, signal) => {
+      if (this.child === child) this.child = null;
+      if (this.stopped || this.socket !== socket2) return;
+      this.log(`herdr exited (code ${code2 ?? "none"}, signal ${signal ?? "none"}); restarting`);
+      this.socket = null;
+      this.emit("down");
+      void this.restart("it exited");
+    });
+    child.unref();
+    const end = Date.now() + READY_MS;
+    while (!await this.answers(socket2)) {
+      if (this.stopped || this.child !== child) return;
+      if (Date.now() > end) {
+        child.kill("SIGTERM");
+        throw new Error(`herdr did not answer on ${socket2} within ${READY_MS / 1e3} s`);
+      }
+      await new Promise((r) => setTimeout(r, 200));
+    }
+    this.socket = socket2;
+    this.pid = child.pid ?? null;
+    if (this.pid !== null) writePrivate2(this.stateFile, `${JSON.stringify({ socket: socket2, pid: this.pid })}
+`);
+    this.failures = 0;
+    this.backoff = 1e3;
+    this.log(`herdr ${this.o.version ?? HERDR_VERSION} started (pid ${this.pid ?? "?"})`);
+    this.emit("ready", socket2, { restored: true });
+  }
+  watch() {
+    if (this.checker) clearInterval(this.checker);
+    this.checker = setInterval(() => void this.check(), this.o.checkMs ?? CHECK_MS);
+    this.checker.unref();
+  }
+  /** One health check: two failures in a row and herdr is restarted. */
+  async check() {
+    if (this.stopped || this.restarting || !this.socket) return;
+    if (await this.answers(this.socket)) {
+      this.failures = 0;
+      return;
+    }
+    this.failures += 1;
+    this.log(`herdr: its control socket did not answer (${this.failures} of ${FAILED_CHECKS})`);
+    if (this.failures >= FAILED_CHECKS) await this.restart("its control socket stopped answering");
+  }
+  /** Stop the server and start a fresh one (a hang, an exit, an update while idle). */
+  restart(reason) {
+    if (this.restarting) return this.restarting;
+    this.restarting = (async () => {
+      this.log(`herdr: restarting (${reason})`);
+      this.failures = 0;
+      const child = this.child;
+      this.child = null;
+      if (child) child.kill("SIGTERM");
+      else if (this.pid !== null) this.kill(this.pid);
+      this.socket = null;
+      this.emit("down");
+      for (; ; ) {
+        if (this.stopped) return;
+        try {
+          await this.spawnServer();
+          return;
+        } catch (err) {
+          this.log(`herdr: ${err.message}; trying again in ${this.backoff / 1e3} s`);
+          await new Promise((r) => setTimeout(r, this.backoff));
+          this.backoff = Math.min(this.backoff * 2, 3e4);
+        }
+      }
+    })().finally(() => {
+      this.restarting = null;
+    });
+    return this.restarting;
+  }
+  /** No agent is running (the updater replaces herdr and Claude Code only then). */
+  async idle() {
+    if (!this.socket) return true;
+    try {
+      const r = await request(this.socket, "session.snapshot", {}, { timeoutMs: 5e3 });
+      return (r.snapshot.agents ?? []).length === 0;
+    } catch {
+      return false;
+    }
+  }
+  /** Stop supervising. herdr keeps running (its agents with it) unless `kill`. */
+  stop(kill = false) {
+    this.stopped = true;
+    if (this.checker) clearInterval(this.checker);
+    this.checker = null;
+    if (kill) {
+      if (this.child) this.child.kill("SIGTERM");
+      else if (this.pid !== null) this.kill(this.pid);
+    }
+  }
+};
+
+// src/node/server.ts
+import http from "node:http";
+var MAX_BODY = 64 * 1024;
+function json(res, status3, body) {
+  const text = JSON.stringify(body);
+  res.writeHead(status3, { "content-type": "application/json", "content-length": Buffer.byteLength(text), "cache-control": "no-store" });
+  res.end(text);
+}
+function readJson(req) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > MAX_BODY) {
+        resolve(null);
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      try {
+        const v = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+        resolve(typeof v === "object" && v !== null && !Array.isArray(v) ? v : null);
+      } catch {
+        resolve(null);
+      }
+    });
+    req.on("error", () => resolve(null));
+  });
+}
+function refuseSocket(socket2, status3, body) {
+  const text = JSON.stringify(body);
+  socket2.end(
+    `HTTP/1.1 ${status3} ${http.STATUS_CODES[status3] ?? ""}\r
+Connection: close\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(text)}\r
+\r
+${text}`
+  );
+}
+var NodeServer = class {
+  constructor(o) {
+    this.o = o;
+    this.server = http.createServer({ requestTimeout: 0, headersTimeout: 3e4, keepAliveTimeout: 6e4 }, (req, res) => {
+      void this.handle(req, res).catch((err) => {
+        o.log?.(`server: ${err.message}`);
+        if (!res.headersSent) json(res, 500, { error: "internal" });
+        else res.destroy();
+      });
+    });
+    this.server.on("upgrade", (req, socket2, head) => this.upgrade(req, socket2, head));
+    this.server.on("clientError", (_err, socket2) => socket2.destroy());
+  }
+  o;
+  server;
+  wss = new import_websocket_server.default({ noServer: true, maxPayload: 1024 * 1024 });
+  opens = /* @__PURE__ */ new WeakMap();
+  channels = /* @__PURE__ */ new Set();
+  /** A stream from the link: a connection to this server. */
+  accept(stream, open3) {
+    this.opens.set(stream, open3);
+    this.server.emit("connection", stream);
+  }
+  openOf(req) {
+    return this.opens.get(req.socket) ?? { kind: "http", session: null, grant: null };
+  }
+  /** Why `need` is not allowed for this stream now, or `null`. */
+  refusal(need, open3) {
+    const l = this.o.policy();
+    if (need === "terminals" && !l.policy.terminals) {
+      return {
+        status: 403,
+        body: { error: "terminals_off", message: l.problem ? `this machine's policy denies everything: ${l.problem}` : "terminals are off in this machine's policy.json" }
+      };
+    }
+    if (!this.o.presence.check(open3.grant, open3.session)) {
+      return { status: 401, body: { error: "presence", message: "this machine wants proof that you are there: the machines passphrase" } };
+    }
+    return null;
+  }
+  /** Close every channel the policy or presence no longer allows. Returns how many. */
+  enforce() {
+    let n = 0;
+    for (const ch of [...this.channels]) {
+      if (this.refusal(ch.need, ch.open) === null) continue;
+      this.channels.delete(ch);
+      ch.close();
+      n += 1;
+    }
+    return n;
+  }
+  /** Track a channel for as long as `until` lasts; holds its grant from idling out. */
+  channel(need, open3, close, onEnd) {
+    const ch = { need, open: open3, close };
+    this.channels.add(ch);
+    const release = open3.grant ? this.o.presence.hold(open3.grant) : () => {
+    };
+    onEnd(() => {
+      this.channels.delete(ch);
+      release();
+    });
+  }
+  get openChannels() {
+    return this.channels.size;
+  }
+  async handle(req, res) {
+    const url = new URL(req.url ?? "/", "http://machine");
+    const open3 = this.openOf(req);
+    const route = `${req.method} ${url.pathname}`;
+    switch (route) {
+      case "GET /api/health": {
+        const hub = this.o.hub();
+        const l = this.o.policy();
+        return json(res, 200, {
+          ok: true,
+          herdr: { connected: hub?.connected ?? false, version: hub?.version ?? null, protocol: hub?.protocol ?? null },
+          workspaceRoot: this.o.home,
+          homeRoot: this.o.home,
+          sharing: false,
+          publicUrl: null,
+          machine: { terminals: l.policy.terminals, problem: l.problem, presenceLocked: this.o.presence.locked() }
+        });
+      }
+      case "POST /presence/challenge": {
+        await readJson(req);
+        const c = this.o.presence.challenge(open3.session);
+        if (c === null) return json(res, 400, { error: "no_session", message: "no machines session" });
+        if ("locked" in c) return json(res, 429, { error: "locked", until: c.until, message: lockedMessage(c.until) });
+        return json(res, 200, c);
+      }
+      case "POST /presence/answer": {
+        const b = await readJson(req);
+        const r = this.o.presence.answer(open3.session, typeof b?.challenge === "string" ? b.challenge : "", typeof b?.answer === "string" ? b.answer : "");
+        if (r.ok) return json(res, 200, { grant: r.grant, expiresAt: r.expiresAt });
+        if (r.error === "locked") return json(res, 429, { error: "locked", until: r.until, message: lockedMessage(r.until) });
+        if (r.error === "wrong") return json(res, 401, { error: "wrong", message: "That is not this machine's passphrase.", failures: r.failures });
+        return json(res, 400, { error: r.error, message: "That challenge has expired; try again." });
+      }
+      case "GET /api/session":
+      case "POST /api/rpc": {
+        const no = this.refusal("terminals", open3);
+        if (no) return json(res, no.status, no.body);
+        const socket2 = this.o.herdrSocket();
+        if (!socket2) return json(res, 503, { error: "herdr", message: "herdr is starting on this machine" });
+        this.channel(
+          "terminals",
+          open3,
+          () => res.destroy(),
+          (cb) => res.once("close", cb)
+        );
+        if (route === "GET /api/session") {
+          const hub = this.o.hub();
+          if (!hub) return json(res, 503, { error: "herdr", message: "herdr is starting on this machine" });
+          try {
+            return json(res, 200, await hub.snapshot());
+          } catch (err) {
+            return json(res, 502, { error: "herdr", message: err.message });
+          }
+        }
+        const b = await readJson(req);
+        const method = b?.method;
+        if (typeof method !== "string") return json(res, 400, { error: "method required" });
+        if (!isAllowed(method)) return json(res, 403, { error: "method not allowed" });
+        const params = typeof b?.params === "object" && b.params !== null ? b.params : {};
+        try {
+          return json(res, 200, { result: await request(socket2, method, params) });
+        } catch (err) {
+          if (err instanceof HerdrError) return json(res, 502, { error: { code: err.code, message: err.message } });
+          return json(res, 502, { error: { code: "unreachable", message: err.message } });
+        }
+      }
+      default:
+        return json(res, 404, { error: "not found" });
+    }
+  }
+  upgrade(req, socket2, head) {
+    socket2.on("error", () => socket2.destroy());
+    const url = new URL(req.url ?? "/", "http://machine");
+    const open3 = this.openOf(req);
+    if (url.pathname !== "/ws/terminal" && url.pathname !== "/ws/events") return refuseSocket(socket2, 404, { error: "not found" });
+    const no = this.refusal("terminals", open3);
+    if (no) return refuseSocket(socket2, no.status, no.body);
+    const streams = this.o.streams();
+    const hub = this.o.hub();
+    if (!streams || !hub) return refuseSocket(socket2, 503, { error: "herdr", message: "herdr is starting on this machine" });
+    this.wss.handleUpgrade(req, socket2, head, (ws) => {
+      this.channel(
+        "terminals",
+        open3,
+        () => ws.terminate(),
+        (cb) => ws.once("close", cb)
+      );
+      if (url.pathname === "/ws/terminal") {
+        serveTerminalSocket(ws, streams, { pane: url.searchParams.get("pane") ?? void 0, cols: url.searchParams.get("cols") ?? void 0, rows: url.searchParams.get("rows") ?? void 0 });
+        return;
+      }
+      this.events(ws, hub);
+    });
+  }
+  /** `/ws/events`: a fresh snapshot, then every hub message as it comes. */
+  events(ws, hub) {
+    heartbeat(ws);
+    let off = null;
+    const send = (m) => {
+      if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(m));
+    };
+    hub.snapshot().then(
+      (snapshot) => {
+        if (ws.readyState !== ws.OPEN) return;
+        send({ kind: "snapshot", snapshot });
+        off = hub.on(send);
+      },
+      () => ws.close()
+    );
+    ws.on("close", () => off?.());
+  }
+  close() {
+    for (const ch of [...this.channels]) ch.close();
+    this.channels.clear();
+    this.wss.close();
+    this.server.close();
+  }
+};
+function lockedMessage(until) {
+  const mins = Math.max(1, Math.ceil((until - Date.now()) / 6e4));
+  return `Too many wrong passphrases: this machine has locked presence for ${mins} more minute${mins === 1 ? "" : "s"}.`;
+}
+
+// src/node/service-linux.ts
+import { execFile } from "node:child_process";
+import fs17 from "node:fs";
+import os9 from "node:os";
+import path15 from "node:path";
+var UNIT_NAME = "agentbox-node.service";
+var runCommand = (cmd, args) => new Promise((resolve) => {
+  execFile(cmd, args, { timeout: 3e4 }, (err, stdout, stderr) => {
+    const code2 = err ? typeof err.code === "number" ? err.code : 127 : 0;
+    resolve({ code: code2, stdout: String(stdout), stderr: String(stderr) });
+  });
+});
+function unitDir(env = process.env, home2 = os9.homedir()) {
+  const xdg = env.XDG_CONFIG_HOME;
+  return path15.join(xdg && path15.isAbsolute(xdg) ? xdg : path15.join(home2, ".config"), "systemd", "user");
+}
+function execStart(execPath = process.execPath, script = process.argv[1]) {
+  const isSea = script === void 0 || path15.resolve(script) === path15.resolve(execPath);
+  return isSea ? [execPath, "node", "run"] : [execPath, path15.resolve(script), "node", "run"];
+}
+function quote(arg) {
+  return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%")}"`;
+}
+function unitText(command2) {
+  return [
+    "[Unit]",
+    "Description=agentbox node: this machine's link to its box",
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `ExecStart=${command2.map(quote).join(" ")}`,
+    "Restart=on-failure",
+    "RestartSec=5",
+    // herdr, and the agents in it, outlive a restart of the node (an
+    // update, a crash); the next node adopts it.
+    "KillMode=process",
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+async function installService(opts) {
+  const run4 = opts.run ?? runCommand;
+  const dir = unitDir(opts.env);
+  fs17.mkdirSync(dir, { recursive: true });
+  const unitFile = path15.join(dir, UNIT_NAME);
+  fs17.writeFileSync(unitFile, unitText(opts.command), { mode: 420 });
+  for (const args of [["--user", "daemon-reload"], ["--user", "enable", UNIT_NAME], ["--user", "restart", UNIT_NAME]]) {
+    const r = await run4("systemctl", args);
+    if (r.code !== 0) {
+      throw new Error(`systemctl ${args.join(" ")} failed: ${(r.stderr || r.stdout).trim() || `exit ${r.code}`}`);
+    }
+  }
+  const user = opts.user ?? os9.userInfo().username;
+  const linger = await run4("loginctl", ["enable-linger", user]);
+  if (linger.code === 0) return { unitFile, lingering: true, note: null };
+  const cron = `@reboot ${opts.command.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`;
+  return {
+    unitFile,
+    lingering: false,
+    note: `This machine does not let the node keep running after you log out (loginctl enable-linger was refused), so it runs while you are logged in. To start it at boot instead, add this line with \`crontab -e\`:
+    ${cron}`
+  };
+}
+async function removeService(opts = {}) {
+  const run4 = opts.run ?? runCommand;
+  const unitFile = path15.join(unitDir(opts.env), UNIT_NAME);
+  if (!fs17.existsSync(unitFile)) return false;
+  await run4("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
+  fs17.rmSync(unitFile, { force: true });
+  await run4("systemctl", ["--user", "daemon-reload"]);
+  return true;
+}
+function serviceInstalled(env = process.env) {
+  return fs17.existsSync(path15.join(unitDir(env), UNIT_NAME));
+}
+
+// src/node/specs.ts
+import { execFile as execFile2 } from "node:child_process";
+import fs18 from "node:fs";
+import os10 from "node:os";
+import path16 from "node:path";
+function run(cmd, args, timeoutMs = 3e3) {
+  return new Promise((resolve) => {
+    execFile2(cmd, args, { timeout: timeoutMs, windowsHide: true, maxBuffer: 256 * 1024 }, (err, stdout) => resolve(err ? null : stdout));
+  });
+}
+function onPath(cmd, env) {
+  const exts = process.platform === "win32" ? [".exe", ".cmd", ""] : [""];
+  for (const dir of (env.PATH ?? "").split(path16.delimiter)) {
+    for (const ext of exts) {
+      try {
+        fs18.accessSync(path16.join(dir, cmd + ext), fs18.constants.X_OK);
+        return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+async function gpus(env) {
+  if (onPath("nvidia-smi", env)) {
+    const out = await run("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader,nounits"]);
+    if (out) {
+      return out.split("\n").map((l) => l.split(",").map((s) => s.trim())).filter((p) => p[0]).map(([name, mem]) => ({ name, memoryMiB: Number(mem) || null }));
+    }
+  }
+  if (onPath("rocm-smi", env)) {
+    const out = await run("rocm-smi", ["--showproductname", "--csv"]);
+    if (out) {
+      return out.split("\n").slice(1).map((l) => l.split(",")[2]?.trim() ?? "").filter(Boolean).map((name) => ({ name, memoryMiB: null }));
+    }
+  }
+  return [];
+}
+function freeBytes(dir) {
+  try {
+    const s = fs18.statfsSync(dir);
+    return s.bavail * s.bsize;
+  } catch {
+    return null;
+  }
+}
+async function claudeVersion(binDir, env) {
+  const own = path16.join(binDir, process.platform === "win32" ? "claude.exe" : "claude");
+  const cmd = fs18.existsSync(own) ? own : onPath("claude", env) ? "claude" : null;
+  if (!cmd) return null;
+  const out = await run(cmd, ["--version"], 5e3);
+  return out ? /\d+\.\d+\.\d+/.exec(out)?.[0] ?? null : null;
+}
+async function gatherSpecs(opts) {
+  const env = opts.env ?? process.env;
+  const cpus = os10.cpus();
+  const disks = [];
+  for (const f of opts.policy.files) {
+    const free = freeBytes(f.path);
+    if (free !== null) disks.push({ path: f.path, freeBytes: free });
+  }
+  return {
+    platform: process.platform,
+    arch: process.arch,
+    hostname: os10.hostname(),
+    cpu: { model: cpus[0]?.model ?? "", cores: cpus.length },
+    ramBytes: os10.totalmem(),
+    disks,
+    gpus: await gpus(env),
+    docker: onPath("docker", env),
+    claude: await claudeVersion(opts.binDir, env)
+  };
+}
+
+// src/node/run.ts
+var RESTART_EXIT = 75;
+var HEADLESS = { cols: 200, rows: 50, ms: 3e4 };
+async function runNode(o) {
+  const now = o.now ?? Date.now;
+  const creds = readCredentials(o.paths.credentials);
+  if (!creds) throw new CliError("this machine has not joined a box; run `agentbox node join <box>`", EXIT.NOT_FOUND);
+  if (creds.revokedAt !== void 0) {
+    o.log(`this machine was revoked by ${creds.box} on ${new Date(creds.revokedAt).toISOString()}; re-join it to use it again`);
+    return EXIT.OK;
+  }
+  if (await callControl(o.paths.control, o.paths.controlSecret, "status", 2e3) !== null) {
+    throw new CliError("a node is already running on this machine (see `agentbox node status`)");
+  }
+  let policy = loadPolicy(o.paths.policy, o.home);
+  const claude = claudePaths(o.paths);
+  prepareClaude(claude, { home: o.home, machine: creds.name });
+  const herdrEnv = { ...process.env, PATH: [claude.shims, o.paths.bin, process.env.PATH ?? ""].join(path17.delimiter) };
+  delete herdrEnv.CLAUDE_CODE_OAUTH_TOKEN;
+  const presence = new PresenceGate({ presence: creds.presence, machineId: creds.machineId, hours: () => policy.policy.presenceHours, now, log: o.log });
+  let hub = null;
+  let streams = null;
+  const herdrBin = path17.join(o.paths.bin, process.platform === "win32" ? "herdr.exe" : "herdr");
+  const herdr = fs19.existsSync(herdrBin) ? new HerdrSupervisor({ bin: herdrBin, dir: o.paths.dir, env: herdrEnv }) : null;
+  if (!herdr) o.log(`herdr is not installed (${herdrBin}); terminals and agents are unavailable until \`agentbox node join\` installs it`);
+  const server = new NodeServer({
+    herdrSocket: () => herdr?.socketPath ?? null,
+    hub: () => hub,
+    streams: () => streams,
+    policy: () => policy,
+    presence,
+    home: o.home,
+    log: o.log
+  });
+  herdr?.on("log", (line) => o.log(line));
+  herdr?.on("down", () => {
+    hub?.stop();
+    hub = null;
+    streams?.stop();
+    streams = null;
+  });
+  herdr?.on("ready", (socket2, info) => {
+    hub?.stop();
+    streams?.stop();
+    const h = new SessionHub(socket2);
+    hub = h;
+    streams = new TerminalStreams({ ...herdrEnv, HERDR_SOCKET_PATH: socket2, HERDR_SESSION });
+    const own = streams;
+    const connect = (tries) => {
+      h.start().then(
+        async () => {
+          if (!info.restored || hub !== h) return;
+          const snap = await h.snapshot().catch(() => null);
+          const quiet = { send: () => {
+          }, sendJson: () => {
+          }, close: () => {
+          } };
+          const held = (snap?.panes ?? []).map((p) => own.attach(p.pane_id, quiet, HEADLESS.cols, HEADLESS.rows));
+          if (held.length) o.log(`herdr: ${held.length} restored pane(s) attached headless at ${HEADLESS.cols}\xD7${HEADLESS.rows}`);
+          setTimeout(() => held.forEach((a) => a.detach()), HEADLESS.ms).unref();
+        },
+        () => {
+          if (hub === h && tries > 0) setTimeout(() => connect(tries - 1), 1e3).unref();
+        }
+      );
+    };
+    connect(10);
+  });
+  const sayPolicy = (l) => {
+    if (l.problem) o.log(`policy: ${l.problem}; everything is denied until it is fixed`);
+    else o.log(`policy: terminals ${l.policy.terminals ? "on" : "off"}, ${l.policy.files.length} folder(s), ports ${l.policy.ports ? "on" : "off"}${l.policy.paused ? ", paused" : ""}`);
+  };
+  sayPolicy(policy);
+  const link = new NodeLink({
+    box: creds.box,
+    token: creds.token,
+    machineId: creds.machineId,
+    version: o.version,
+    describe: async () => {
+      const summary = summarize(policy);
+      return { ...await gatherSpecs({ binDir: o.paths.bin, policy: summary }), policy: summary };
+    },
+    ...o.link ?? {}
+  });
+  link.on("log", (line) => o.log(line));
+  link.on("stream", (stream, open3) => server.accept(stream, open3));
+  link.on("control", (m) => {
+    if (m.type !== "claude-token") return;
+    const token = typeof m.token === "string" ? m.token : null;
+    holdToken(claude, token);
+    o.log(token ? "the box sent the shared Claude sign-in; new Claude Code sessions here use it" : "the box withdrew the shared Claude sign-in from this machine");
+  });
+  link.on("state", (state) => o.log(`link: ${state}`));
+  if (policy.policy.paused) link.pause();
+  const stopWatching = watchPolicy(o.paths.policy, o.home, (l) => {
+    policy = l;
+    sayPolicy(l);
+    const closed = server.enforce();
+    if (closed) o.log(`policy: closed ${closed} channel(s) it no longer allows`);
+    if (l.policy.paused && !link.isPaused) link.pause();
+    else if (!l.policy.paused && link.isPaused) link.resume();
+    else link.sendPolicy(summarize(l));
+  });
+  let finish = () => {
+  };
+  const done = new Promise((r) => finish = r);
+  const control2 = await startControl(o.paths.control, o.paths.controlSecret, async (command2) => {
+    switch (command2) {
+      case "status":
+        return {
+          state: link.state,
+          box: creds.box,
+          machineId: creds.machineId,
+          name: creds.name,
+          paused: link.isPaused,
+          policyProblem: policy.problem,
+          pid: process.pid,
+          herdrSocket: herdr?.socketPath ?? null,
+          presenceLocked: presence.locked(),
+          channels: server.openChannels
+        };
+      case "pause":
+        setPaused(o.paths.policy, true);
+        link.pause();
+        return { state: link.state };
+      case "resume":
+        setPaused(o.paths.policy, false);
+        link.resume();
+        return { state: link.state };
+      case "leave": {
+        const told = await link.leave();
+        setImmediate(() => finish(EXIT.OK));
+        return { told };
+      }
+    }
+  });
+  link.on("revoked", () => {
+    fs19.rmSync(o.paths.secrets, { recursive: true, force: true });
+    writeCredentials(o.paths.credentials, { ...creds, revokedAt: now() });
+    o.log(`${creds.box} revoked this machine. Its shared secrets are wiped; everything else is kept. Re-join it to use it again.`);
+    finish(EXIT.OK);
+  });
+  link.on("state", (state) => {
+    if (state === "left") finish(EXIT.OK);
+  });
+  o.signal.addEventListener("abort", () => finish(EXIT.OK), { once: true });
+  let checking = false;
+  const checkUpdates = async () => {
+    if (checking || o.checkUpdates === false) return;
+    checking = true;
+    try {
+      const herdrPath = herdrBin;
+      const report = await checkForUpdate({
+        policy: policy.policy.updates,
+        running: o.version,
+        // Only the standalone executable replaces itself; agentbox.mjs under Node does not.
+        nodePath: execStart().length === 3 ? process.execPath : null,
+        ...fs19.existsSync(herdrPath) ? { herdr: { path: herdrPath, version: HERDR_VERSION } } : {},
+        ...installedClaude(claude) ? { claude: { path: claude.bin, version: installedClaude(claude), versionFile: claude.versionFile } } : {},
+        // Agents live in herdr: herdr and Claude Code are replaced only while none runs.
+        idle: () => herdr ? herdr.idle() : true
+      });
+      o.log(`update: ${describeReport(report)}`);
+      if ((report.state === "current" || report.state === "updated") && report.tools.herdr === "updated") void herdr?.restart("updated");
+      if (report.state === "updated" && report.restart) finish(RESTART_EXIT);
+    } catch (err) {
+      o.log(`update check failed: ${err.message}`);
+    } finally {
+      checking = false;
+    }
+  };
+  link.on("upgrade", () => void checkUpdates());
+  const firstCheck = setTimeout(() => void checkUpdates(), 10 * 6e4);
+  firstCheck.unref();
+  const daily = setInterval(() => void checkUpdates(), 24 * 60 * 6e4);
+  daily.unref();
+  const enforcer = setInterval(() => server.enforce(), o.enforceMs ?? 5e3);
+  enforcer.unref();
+  if (herdr) {
+    herdr.start().catch((err) => {
+      o.log(`herdr did not start: ${err.message}; trying again`);
+      void herdr.restart("it did not start");
+    });
+  }
+  link.start();
+  const code2 = await done;
+  clearInterval(enforcer);
+  server.close();
+  herdr?.stop();
+  hub?.stop();
+  streams?.stop();
+  clearTimeout(firstCheck);
+  clearInterval(daily);
+  link.stop(link.state === "revoked" ? "revoked" : "stopped");
+  stopWatching();
+  control2.close();
+  return code2;
+}
+
+// src/commands/node.ts
+function paths(ctx) {
+  return nodePaths(nodeDir(ctx.env, ctx.env.HOME || os11.homedir(), ctx.platform));
+}
+function home(ctx) {
+  return ctx.env.HOME || os11.homedir();
+}
+function parseFolders(raw, homeDir2) {
+  const out = [];
+  for (const part of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+    const m = /^(.*?)(?::(read|write))?$/.exec(part);
+    let p = m[1];
+    if (p === "~") p = homeDir2;
+    else if (p.startsWith("~/")) p = path18.join(homeDir2, p.slice(2));
+    p = path18.resolve(p);
+    if (p === path18.resolve(homeDir2)) throw new UsageError("not the whole home folder: name the project folders the box may use");
+    out.push({ path: p, mode: m[2] ?? "write" });
+  }
+  return out;
+}
+function printPolicy(ctx, p) {
+  try {
+    ctx.err(`${fs20.readFileSync(p.policy, "utf8")}`);
+  } catch {
+    ctx.err("(no policy.json)\n");
+  }
+}
+var join = command({
+  path: ["node", "join"],
+  summary: "join this computer to a box as a machine",
+  usage: "<box-url>",
+  operands: { min: 1, max: 1 },
+  details: "Installs what the node runs (verified), asks for the machines passphrase here, shows a code to type\non the box's machines Admin page, writes policy.json if there is none, and starts the node as a\nsystemd user service.",
+  options: [
+    { name: "name", type: "string", value: "name", description: "what the box calls this machine (default: the hostname)" },
+    { name: "folder", type: "string", value: "dirs", description: "folders the box may use, comma-separated, each dir or dir:read (asked when absent)" },
+    { name: "no-service", type: "boolean", description: "do not register a service; run `agentbox node run` yourself" },
+    { name: "no-claude", type: "boolean", description: "do not install Claude Code (about 280 MiB); agents can be started once it is there" }
+  ],
+  async run(ctx, p) {
+    const box = normalizeBoxUrl(p.operands[0]);
+    const np = paths(ctx);
+    const prompt = new Prompter(ctx.io.stdin, ctx.io.stderr);
+    const folderArg = str(p.options, "folder");
+    const noService = bool(p.options, "no-service") || ctx.platform !== "linux";
+    try {
+      await joinMachine(
+        { box, name: str(p.options, "name") ?? os11.hostname(), folders: folderArg !== void 0 ? parseFolders(folderArg, home(ctx)) : null },
+        {
+          paths: np,
+          platform: ctx.platform,
+          arch: process.arch,
+          hostname: os11.hostname(),
+          now: ctx.now,
+          err: (s) => ctx.err(s),
+          client: ctx.client(box, null),
+          freeBytes,
+          install: async () => {
+            await installHerdr(np.bin, { platform: ctx.platform, arch: process.arch, from: ctx.env.AGENTBOX_NODE_HERDR_FROM || void 0, log: (s) => ctx.err(s) });
+            if (!bool(p.options, "no-claude")) await installClaude(claudePaths(np), { platform: ctx.platform, arch: process.arch, log: (s) => ctx.err(s) });
+          },
+          passphrase: () => askPassphrase(prompt, (s) => ctx.err(s)),
+          enrol: (pass) => enrol(pass, ctx.now()),
+          sleep: (ms) => sleep(ms, ctx.abort.signal),
+          askFolders: async () => {
+            ctx.err("Which project folders may the box use? (comma-separated; add :read for read-only; never your whole home)\n");
+            const answer = await prompt.line("Folders: ");
+            return answer ? parseFolders(answer, home(ctx)) : [];
+          },
+          service: noService ? null : async () => {
+            try {
+              const r = await installService({ command: execStart(), env: ctx.env });
+              ctx.err(`Registered ${UNIT_NAME} (${r.unitFile}).
+`);
+              if (r.note) ctx.err(`${r.note}
+`);
+            } catch (err) {
+              throw new CliError(`${err.message}
+The machine is joined; start it with \`agentbox node run\`.`);
+            }
+          },
+          waitOnline: async () => {
+            const deadline = Date.now() + 6e4;
+            while (Date.now() < deadline) {
+              const s = await callControl(np.control, np.controlSecret, "status", 2e3);
+              if (s?.state === "online") return true;
+              await sleep(1e3, ctx.abort.signal);
+            }
+            return false;
+          },
+          printPolicy: () => printPolicy(ctx, np)
+        }
+      );
+    } finally {
+      prompt.close();
+    }
+  }
+});
+var run2 = command({
+  path: ["node", "run"],
+  summary: "run the node in the foreground (the service runs this)",
+  usage: "",
+  ownsInterrupt: true,
+  async run(ctx) {
+    const np = paths(ctx);
+    const log = (line) => {
+      ctx.err(`${new Date(ctx.now()).toISOString()} ${line}
+`);
+    };
+    return runNode({ paths: np, home: home(ctx), version: VERSION, log, signal: ctx.abort.signal });
+  }
+});
+var status2 = command({
+  path: ["node", "status"],
+  summary: "whether this machine is joined, linked and paused",
+  usage: "",
+  json: true,
+  async run(ctx) {
+    const np = paths(ctx);
+    const creds = readCredentials(np.credentials);
+    const live = await callControl(np.control, np.controlSecret, "status", 3e3);
+    const policy = loadPolicy(np.policy, home(ctx));
+    const out = {
+      joined: creds !== null,
+      box: creds?.box ?? null,
+      machineId: creds?.machineId ?? null,
+      name: creds?.name ?? null,
+      revoked: creds?.revokedAt !== void 0 && creds !== null,
+      running: live !== null,
+      state: live ? live.state : creds ? creds.revokedAt !== void 0 ? "revoked" : "not running" : "not joined",
+      paused: policy.policy.paused,
+      policyProblem: policy.problem,
+      folder: np.dir,
+      service: ctx.platform === "linux" ? serviceInstalled(ctx.env) : false,
+      herdrSocket: typeof live?.herdrSocket === "string" ? live.herdrSocket : null,
+      presenceLocked: typeof live?.presenceLocked === "number" ? live.presenceLocked : null
+    };
+    if (ctx.json) return ctx.printJson(out);
+    if (!creds) {
+      ctx.out(`Not joined to a box. Run \`agentbox node join <box>\`.
+`);
+      return EXIT.NOT_FOUND;
+    }
+    ctx.out(`${safeText(out.name ?? "")} (machine ${safeText(out.machineId ?? "")}) at ${safeText(out.box ?? "")}
+`);
+    ctx.out(`state: ${safeText(String(out.state))}${out.paused ? " (paused: `agentbox node resume`)" : ""}
+`);
+    if (out.policyProblem) ctx.out(`policy: ${safeText(out.policyProblem)} \u2014 everything is denied
+`);
+    ctx.out(`folder: ${np.dir}
+service: ${out.service ? UNIT_NAME : "none"}
+`);
+    if (out.herdrSocket) ctx.out(`herdr: HERDR_SOCKET_PATH=${out.herdrSocket} herdr   (the agents the box sees)
+`);
+    if (out.presenceLocked) ctx.out(`presence: locked until ${new Date(out.presenceLocked).toISOString()} after wrong passphrases
+`);
+  }
+});
+async function setPause(ctx, paused) {
+  const np = paths(ctx);
+  if (!readCredentials(np.credentials)) throw new CliError("this machine has not joined a box", EXIT.NOT_FOUND);
+  const live = await callControl(np.control, np.controlSecret, paused ? "pause" : "resume");
+  if (!live) setPaused(np.policy, paused);
+  else if (live.ok !== true) throw new CliError(String(live.error ?? "the node refused"));
+  ctx.err(paused ? "Paused: the link is down until `agentbox node resume`.\n" : "Resumed.\n");
+}
+var pause = command({ path: ["node", "pause"], summary: "take the link down until resume", usage: "", run: (ctx) => setPause(ctx, true) });
+var resume = command({ path: ["node", "resume"], summary: "bring the link back up", usage: "", run: (ctx) => setPause(ctx, false) });
+var leave = command({
+  path: ["node", "leave"],
+  summary: "leave the box: tell it if it can be reached, and forget this machine's token",
+  usage: "",
+  async run(ctx) {
+    const np = paths(ctx);
+    const creds = readCredentials(np.credentials);
+    if (!creds) throw new CliError("this machine has not joined a box", EXIT.NOT_FOUND);
+    let told = false;
+    const live = await callControl(np.control, np.controlSecret, "leave", 1e4);
+    if (live) told = live.told === true;
+    else if (creds.revokedAt === void 0) {
+      const link = new NodeLink({
+        box: creds.box,
+        token: creds.token,
+        machineId: creds.machineId,
+        version: VERSION,
+        describe: async () => {
+          const policy = summarize(loadPolicy(np.policy, home(ctx)));
+          return { ...await gatherSpecs({ binDir: np.bin, policy }), policy };
+        }
+      });
+      link.start();
+      const deadline = Date.now() + 1e4;
+      while (link.state !== "online" && Date.now() < deadline) await sleep(200);
+      told = await link.leave();
+      link.stop();
+    }
+    if (ctx.platform === "linux") await removeService({ env: ctx.env });
+    fs20.rmSync(np.secrets, { recursive: true, force: true });
+    fs20.rmSync(np.credentials, { force: true });
+    fs20.rmSync(np.controlSecret, { force: true });
+    ctx.err(told ? `Left ${creds.box}.
+` : `Left here; ${creds.box} could not be told, so it lists this machine until the owner removes it.
+`);
+    ctx.err(`Kept ${np.policy} and ${np.bin}.
+`);
+  }
+});
+var logs = command({
+  path: ["node", "logs"],
+  summary: "the node's log (from the journal)",
+  usage: "",
+  ownsInterrupt: true,
+  options: [{ name: "follow", short: "f", type: "boolean", description: "keep printing new lines" }],
+  async run(ctx, p) {
+    const args = ["--user", "-u", UNIT_NAME, "-n", "200", "--no-pager", ...bool(p.options, "follow") ? ["-f"] : []];
+    return new Promise((resolve) => {
+      const child = spawn7("journalctl", args, { stdio: "inherit" });
+      child.on("error", () => {
+        ctx.err("journalctl is not available here; run `agentbox node run` in a terminal to see the log.\n");
+        resolve(EXIT.FAILURE);
+      });
+      child.on("exit", (code2) => resolve(code2 ?? EXIT.OK));
+      ctx.abort.signal.addEventListener("abort", () => child.kill("SIGINT"), { once: true });
+    });
+  }
+});
+var passphrase = command({
+  path: ["node", "passphrase"],
+  summary: "set this machine's copy of the machines passphrase (after it changed on the box)",
+  usage: "",
+  async run(ctx) {
+    const np = paths(ctx);
+    const creds = readCredentials(np.credentials);
+    if (!creds) throw new CliError("this machine has not joined a box", EXIT.NOT_FOUND);
+    const prompt = new Prompter(ctx.io.stdin, ctx.io.stderr);
+    try {
+      const presence = await enrol(await askPassphrase(prompt, (s) => ctx.err(s)), ctx.now());
+      writeCredentials(np.credentials, { ...creds, presence });
+    } finally {
+      prompt.close();
+    }
+    ctx.err("This machine now proves presence with the new passphrase.\n");
+  }
+});
+var NODE_COMMANDS = [join, run2, status2, pause, resume, leave, logs, passphrase];
+
 // src/commands/mount.ts
-import fs8 from "node:fs";
-import os7 from "node:os";
-import path9 from "node:path";
+import fs21 from "node:fs";
+import os12 from "node:os";
+import path19 from "node:path";
 
 // src/dav.ts
-import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import http from "node:http";
+import { randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import http2 from "node:http";
 var REMOTE_PREFIX = "/api/dav";
 var BadPath = class extends Error {
 };
@@ -6858,7 +10180,7 @@ function underPrefix(p, prefix) {
   if (p.length < prefix.length) return false;
   const head = Buffer.from(p.slice(0, prefix.length));
   const want = Buffer.from(prefix);
-  if (head.length !== want.length || !timingSafeEqual(head, want)) return false;
+  if (head.length !== want.length || !timingSafeEqual4(head, want)) return false;
   return p.length === prefix.length || p[prefix.length] === "/";
 }
 var LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "[::1]"];
@@ -6920,20 +10242,20 @@ var DROP_REQUEST = /* @__PURE__ */ new Set(["host", "authorization", "proxy-auth
 var DROP_RESPONSE = /* @__PURE__ */ new Set(["set-cookie", "www-authenticate", "strict-transport-security", "alt-svc"]);
 var MAX_REWRITE = 64 * 1024 * 1024;
 function newCredentials() {
-  return { user: "agentbox", password: randomBytes3(24).toString("base64url") };
+  return { user: "agentbox", password: randomBytes8(24).toString("base64url") };
 }
 function basicMatches(header, want) {
   const m = /^Basic\s+([A-Za-z0-9+/=]+)\s*$/i.exec(header ?? "");
   if (!m) return false;
   const got = Buffer.from(m[1], "base64");
   const expected = Buffer.from(`${want.user}:${want.password}`, "utf8");
-  return got.length === expected.length && timingSafeEqual(got, expected);
+  return got.length === expected.length && timingSafeEqual4(got, expected);
 }
 var DavFront = class {
   constructor(client, opts = {}) {
     this.client = client;
     this.opts = opts;
-    this.secret = opts.secret ?? randomBytes3(16).toString("base64url");
+    this.secret = opts.secret ?? randomBytes8(16).toString("base64url");
     this.credentials = opts.credentials === void 0 ? newCredentials() : opts.credentials;
   }
   client;
@@ -6947,7 +10269,7 @@ var DavFront = class {
   credentials;
   /** Start listening; resolves with the URL to give a WebDAV client. */
   async start() {
-    const server = http.createServer((req, res) => {
+    const server = http2.createServer((req, res) => {
       this.handle(req, res).catch((err) => {
         this.opts.onError?.(err.message);
         if (!res.headersSent) {
@@ -6990,8 +10312,8 @@ var DavFront = class {
   }
   async handle(req, res) {
     const m = this.map;
-    const plain = (status2, text) => {
-      res.writeHead(status2, { "content-type": "text/plain; charset=utf-8", "content-length": String(Buffer.byteLength(text) + 1) });
+    const plain = (status3, text) => {
+      res.writeHead(status3, { "content-type": "text/plain; charset=utf-8", "content-length": String(Buffer.byteLength(text) + 1) });
       res.end(`${text}
 `);
     };
@@ -7070,7 +10392,7 @@ var DavFront = class {
 };
 
 // src/http.ts
-import http2 from "node:http";
+import http3 from "node:http";
 import https from "node:https";
 import { Readable } from "node:stream";
 var USER_AGENT = `agentbox-cli/${VERSION} (node ${process.versions.node}; ${process.platform})`;
@@ -7116,7 +10438,7 @@ function encodeQuery(query, rawQuery) {
   if (rawQuery) parts.push(rawQuery);
   return parts.length ? `?${parts.join("&")}` : "";
 }
-function apiErrorFrom(status2, text, what) {
+function apiErrorFrom(status3, text, what) {
   let message = "";
   let code2 = null;
   try {
@@ -7129,20 +10451,20 @@ function apiErrorFrom(status2, text, what) {
     message = text.trim().split("\n")[0] ?? "";
   }
   message = safeText(message.slice(0, 300));
-  if (status2 === 401) {
+  if (status3 === 401) {
     return new ApiError(401, "the box did not accept this device's sign-in (the token was revoked or has expired); run `agentbox login` again", code2);
   }
-  if (status2 === 502 || status2 === 503 || status2 === 504) {
+  if (status3 === 502 || status3 === 503 || status3 === 504) {
     message = message || "the box is up, but the service behind it is not answering";
   }
-  return new ApiError(status2, `${what}: ${message || `HTTP ${status2}`}`, code2);
+  return new ApiError(status3, `${what}: ${message || `HTTP ${status3}`}`, code2);
 }
 var BoxClient = class {
   constructor(origin, token) {
     this.token = token;
     this.url = new URL(origin);
     this.origin = this.url.origin;
-    const Agent = this.url.protocol === "https:" ? https.Agent : http2.Agent;
+    const Agent = this.url.protocol === "https:" ? https.Agent : http3.Agent;
     this.agent = new Agent({ keepAlive: true, maxSockets: 8 });
   }
   token;
@@ -7165,7 +10487,7 @@ var BoxClient = class {
   get hasToken() {
     return this.token !== null;
   }
-  request(method, path12, opts = {}) {
+  request(method, path22, opts = {}) {
     const headers = { ...this.baseHeaders(opts.auth !== false), ...opts.headers ?? {} };
     let payload = null;
     const body = opts.body;
@@ -7180,8 +10502,8 @@ var BoxClient = class {
       }
       if (Buffer.isBuffer(payload)) headers["content-length"] = String(payload.length);
     }
-    const target = `${path12}${encodeQuery(opts.query, opts.rawQuery)}`;
-    const lib = this.url.protocol === "https:" ? https : http2;
+    const target = `${path22}${encodeQuery(opts.query, opts.rawQuery)}`;
+    const lib = this.url.protocol === "https:" ? https : http3;
     return new Promise((resolve, reject) => {
       const req = lib.request(
         {
@@ -7226,21 +10548,21 @@ var BoxClient = class {
    * A JSON call: the parsed answer on 2xx, else an {@link ApiError} with what
    * the box said. `what` names the action for the message ("listing /x").
    */
-  async json(method, path12, opts = {}) {
-    const res = await this.request(method, path12, { ...opts, headers: { accept: "application/json", ...opts.headers ?? {} } });
+  async json(method, path22, opts = {}) {
+    const res = await this.request(method, path22, { ...opts, headers: { accept: "application/json", ...opts.headers ?? {} } });
     const text = await res.text();
-    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, text, opts.what ?? `${method} ${path12}`);
+    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, text, opts.what ?? `${method} ${path22}`);
     if (res.status === 204 || text === "") return void 0;
     try {
       return JSON.parse(text);
     } catch {
-      throw new CliError(`${opts.what ?? path12}: the box answered with something that is not JSON (is ${this.origin} an agentbox?)`);
+      throw new CliError(`${opts.what ?? path22}: the box answered with something that is not JSON (is ${this.origin} an agentbox?)`);
     }
   }
   /** A request whose answer must be 2xx; the body is left to the caller. */
-  async ok(method, path12, opts = {}) {
-    const res = await this.request(method, path12, opts);
-    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, await res.text(), opts.what ?? `${method} ${path12}`);
+  async ok(method, path22, opts = {}) {
+    const res = await this.request(method, path22, opts);
+    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, await res.text(), opts.what ?? `${method} ${path22}`);
     return res;
   }
   close() {
@@ -7254,11 +10576,11 @@ async function gvfsFolder(root, port, secret, ms) {
   for (; ; ) {
     let names = [];
     try {
-      names = fs8.readdirSync(root);
+      names = fs21.readdirSync(root);
     } catch {
     }
     const name = gvfsMountName(names, port, secret);
-    if (name) return path9.join(root, name);
+    if (name) return path19.join(root, name);
     if (Date.now() > deadline) return null;
     await new Promise((r) => setTimeout(r, 100));
   }
@@ -7318,7 +10640,7 @@ password  ${credentials.password}
       }
       let plan;
       try {
-        plan = mountPlan({ platform: ctx.platform, url, dir, boxName: name, home: os7.homedir(), env: ctx.env, credentials });
+        plan = mountPlan({ platform: ctx.platform, url, dir, boxName: name, home: os12.homedir(), env: ctx.env, credentials });
       } catch (err) {
         throw new CliError(err.message, EXIT.USAGE);
       }
@@ -7327,14 +10649,14 @@ password  ${credentials.password}
         throw new CliError(`${plan.helper} was not found, so the box cannot be mounted here: ${plan.install}. Or serve it with \`agentbox mount --no-mount\` and use any WebDAV client.`);
       }
       let madeMountpoint = false;
-      if (plan.mountpoint && !fs8.existsSync(plan.mountpoint)) {
-        fs8.mkdirSync(plan.mountpoint, { recursive: true });
+      if (plan.mountpoint && !fs21.existsSync(plan.mountpoint)) {
+        fs21.mkdirSync(plan.mountpoint, { recursive: true });
         madeMountpoint = true;
       }
-      if (plan.link && fs8.existsSync(plan.link)) throw new CliError(`${plan.link} already exists; name a new folder for the link, or leave it out`);
+      if (plan.link && fs21.existsSync(plan.link)) throw new CliError(`${plan.link} already exists; name a new folder for the link, or leave it out`);
       const mounted = await runStep(plan.mount, helper, ctx.env);
       if (mounted.code !== 0) {
-        if (madeMountpoint) fs8.rmSync(plan.mountpoint, { recursive: false, force: true });
+        if (madeMountpoint) fs21.rmSync(plan.mountpoint, { recursive: false, force: true });
         throw new CliError(`${plan.helper} could not mount it${mounted.output ? `: ${mounted.output}` : ""}`);
       }
       let where = plan.where;
@@ -7356,7 +10678,7 @@ password  ${credentials.password}
       }
       let linked = false;
       if (plan.link && where) {
-        fs8.symlinkSync(where, plan.link, "dir");
+        fs21.symlinkSync(where, plan.link, "dir");
         linked = true;
       }
       if (!gioOnly) {
@@ -7371,10 +10693,10 @@ password  ${credentials.password}
         const done = await runStep(unmount, findOnPath(unmount.command, ctx.env, ctx.platform) ?? unmount.command, ctx.env);
         if (done.code !== 0) ctx.warn(`${unmount.command} ${unmount.args.join(" ")} failed${done.output ? `: ${done.output}` : ""}; unmount it yourself`);
       }
-      if (linked) fs8.rmSync(plan.link, { force: true });
+      if (linked) fs21.rmSync(plan.link, { force: true });
       if (madeMountpoint) {
         try {
-          fs8.rmdirSync(plan.mountpoint);
+          fs21.rmdirSync(plan.mountpoint);
         } catch {
         }
       }
@@ -7386,12 +10708,12 @@ password  ${credentials.password}
 var MOUNT_COMMANDS = [mount];
 
 // src/commands/terminal.ts
-import fs9 from "node:fs";
-import os8 from "node:os";
-import path10 from "node:path";
+import fs22 from "node:fs";
+import os13 from "node:os";
+import path20 from "node:path";
 
 // src/ttyd.ts
-import { EventEmitter } from "node:events";
+import { EventEmitter as EventEmitter3 } from "node:events";
 var CLIENT = { INPUT: 48, RESIZE: 49, PAUSE: 50, RESUME: 51 };
 var SERVER = { OUTPUT: 48, TITLE: 49, PREFERENCES: 50 };
 function handshakeFrame(columns, rows, authToken = "") {
@@ -7426,7 +10748,7 @@ function parseServerFrame(frame) {
       return { kind: "unknown", command: command2 ?? -1 };
   }
 }
-var TtydSession = class extends EventEmitter {
+var TtydSession = class extends EventEmitter3 {
   constructor(client, basePath) {
     super();
     this.client = client;
@@ -7464,9 +10786,9 @@ var TtydSession = class extends EventEmitter {
       else if (parsed.kind === "title") this.emit("title", parsed.title);
     });
     ws.on("unexpected-response", (_req, res) => {
-      const status2 = res.statusCode ?? 0;
+      const status3 = res.statusCode ?? 0;
       res.resume();
-      const message = status2 === 401 ? "the box did not accept this device's sign-in; run `agentbox login` again" : status2 === 403 ? "the box refused the terminal (origin check); is the box's URL right?" : status2 === 404 ? `this box has no ${this.basePath} terminal` : status2 === 502 || status2 === 503 ? `the ${this.basePath} terminal is not running on the box` : `the box refused the terminal (HTTP ${status2})`;
+      const message = status3 === 401 ? "the box did not accept this device's sign-in; run `agentbox login` again" : status3 === 403 ? "the box refused the terminal (origin check); is the box's URL right?" : status3 === 404 ? `this box has no ${this.basePath} terminal` : status3 === 502 || status3 === 503 ? `the ${this.basePath} terminal is not running on the box` : `the box refused the terminal (HTTP ${status3})`;
       this.finish({ reason: "error", message });
       ws.terminate();
     });
@@ -7864,11 +11186,11 @@ agentbox: ${message}\r
 
 // src/commands/terminal.ts
 function cdCommand(dir) {
-  const quote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+  const quote2 = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
   let target;
   if (dir === "~") target = "~";
-  else if (dir.startsWith("~/")) target = `~/${quote(dir.slice(2))}`;
-  else target = quote(dir);
+  else if (dir.startsWith("~/")) target = `~/${quote2(dir.slice(2))}`;
+  else target = quote2(dir);
   return ` cd -- ${target} && clear\r`;
 }
 async function connectTerminal(ctx, basePath, initialInput) {
@@ -7920,8 +11242,8 @@ the network: faster, and no redraw glitches. Install it now with herdr's install
     ctx.warn(`herdr's installer exited ${code2}`);
     return null;
   }
-  const home = (win ? ctx.env.USERPROFILE : ctx.env.HOME) || os8.homedir();
-  return findOnPath("herdr", ctx.env, ctx.platform) ?? [path10.join(home, ".local", "bin", "herdr")].find((f) => fs9.existsSync(f)) ?? null;
+  const home2 = (win ? ctx.env.USERPROFILE : ctx.env.HOME) || os13.homedir();
+  return findOnPath("herdr", ctx.env, ctx.platform) ?? [path20.join(home2, ".local", "bin", "herdr")].find((f) => fs22.existsSync(f)) ?? null;
 }
 var attach = command({
   path: ["attach"],
@@ -7971,10 +11293,11 @@ var shell = command({
 var TERMINAL_COMMANDS = [attach, shell];
 
 // src/commands/update.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { randomBytes as randomBytes4 } from "node:crypto";
-import fs10 from "node:fs";
-import path11 from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { randomBytes as randomBytes9 } from "node:crypto";
+import fs23 from "node:fs";
+import os14 from "node:os";
+import path21 from "node:path";
 var MAX_BUNDLE = 16 * 1024 * 1024;
 function bundleVersion(bundle) {
   const head = (typeof bundle === "string" ? bundle : bundle.subarray(0, 512).toString("utf8")).split("\n", 3);
@@ -7987,17 +11310,17 @@ function selfInstall(argv1) {
   if (!argv1) return null;
   let file;
   try {
-    file = fs10.realpathSync(argv1);
+    file = fs23.realpathSync(argv1);
   } catch {
     return null;
   }
   let checkout = false;
   let npm = false;
   try {
-    const root = path11.join(path11.dirname(file), "..");
-    const pkg = JSON.parse(fs10.readFileSync(path11.join(root, "package.json"), "utf8"));
+    const root = path21.join(path21.dirname(file), "..");
+    const pkg = JSON.parse(fs23.readFileSync(path21.join(root, "package.json"), "utf8"));
     if (pkg.name === NPM_PACKAGE) {
-      if (fs10.existsSync(path11.join(root, "src", "cli.ts"))) checkout = true;
+      if (fs23.existsSync(path21.join(root, "src", "cli.ts"))) checkout = true;
       else npm = true;
     }
   } catch {
@@ -8008,6 +11331,27 @@ function npmVersionFor(boxVersion) {
   const m = /^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)$/.exec(boxVersion ?? "");
   return m ? m[1] : "latest";
 }
+function nodeCredentials(env, platform = process.platform) {
+  const candidates = [];
+  if (platform === "win32") {
+    if (env.LOCALAPPDATA && path21.win32.isAbsolute(env.LOCALAPPDATA)) candidates.push(path21.join(env.LOCALAPPDATA, "agentbox", "node", "credentials.json"));
+  } else {
+    const xdg = env.XDG_DATA_HOME;
+    if (xdg && path21.isAbsolute(xdg)) candidates.push(path21.join(xdg, "agentbox", "node", "credentials.json"));
+    candidates.push(path21.join(env.HOME || os14.homedir(), ".local", "share", "agentbox", "node", "credentials.json"));
+  }
+  return candidates.find((f) => fs23.existsSync(f)) ?? null;
+}
+function signedUpdatesOnly(env, platform = process.platform, standalone = STANDALONE) {
+  const creds = nodeCredentials(env, platform);
+  if (creds) {
+    return `this machine is joined to a box as a node (${creds}), so agentbox here updates only from signed releases, never from a box: the node checks for them itself (\`updates\` in its policy.json), or see https://github.com/jabezpauls/agentbox/releases`;
+  }
+  if (standalone) {
+    return "this is the standalone agentbox, which updates only from signed releases, never from a box; download the latest from https://github.com/jabezpauls/agentbox/releases";
+  }
+  return null;
+}
 var update = command({
   path: ["update"],
   summary: "replace this CLI with the box's own build",
@@ -8018,6 +11362,8 @@ var update = command({
   ],
   details: "Downloads /cli/agentbox.mjs from the box (the current one, or --box), checks it runs, and swaps it in\nin one step.",
   async run(ctx, p) {
+    const signedOnly = signedUpdatesOnly(ctx.env, ctx.platform);
+    if (signedOnly) throw new CliError(signedOnly);
     const { name, box } = ctx.selected();
     const self = selfInstall(process.argv[1]);
     if (!self) throw new CliError("cannot tell which file this CLI runs from");
@@ -8062,7 +11408,7 @@ var update = command({
       }
       return;
     }
-    const current = fs10.readFileSync(self.file);
+    const current = fs23.readFileSync(self.file);
     if (bundle.equals(current)) {
       ctx.out(`Already up to date: agentbox ${VERSION}, the same build ${name} serves.
 `);
@@ -8073,24 +11419,24 @@ var update = command({
 `);
       return;
     }
-    const dir = path11.dirname(self.file);
-    const tmp = path11.join(dir, `.agentbox-update-${randomBytes4(4).toString("hex")}.mjs`);
+    const dir = path21.dirname(self.file);
+    const tmp = path21.join(dir, `.agentbox-update-${randomBytes9(4).toString("hex")}.mjs`);
     try {
-      fs10.writeFileSync(tmp, bundle, { mode: 493 });
-      fs10.chmodSync(tmp, 493);
+      fs23.writeFileSync(tmp, bundle, { mode: 493 });
+      fs23.chmodSync(tmp, 493);
     } catch (err) {
-      fs10.rmSync(tmp, { force: true });
+      fs23.rmSync(tmp, { force: true });
       throw new CliError(`cannot write to ${dir} (${err.message}); reinstall with the box's install script`);
     }
-    const check = spawnSync2(process.execPath, [tmp, "--version"], { encoding: "utf8", timeout: 3e4 });
+    const check = spawnSync3(process.execPath, [tmp, "--version"], { encoding: "utf8", timeout: 3e4 });
     if (check.status !== 0) {
-      fs10.rmSync(tmp, { force: true });
+      fs23.rmSync(tmp, { force: true });
       throw new CliError(`the downloaded build does not run here: ${(check.stderr || check.stdout || "").trim().slice(0, 300)}`);
     }
     try {
-      fs10.renameSync(tmp, self.file);
+      fs23.renameSync(tmp, self.file);
     } catch (err) {
-      fs10.rmSync(tmp, { force: true });
+      fs23.rmSync(tmp, { force: true });
       throw new CliError(`cannot replace ${self.file}: ${err.message}`);
     }
     ctx.out(`Updated agentbox ${VERSION} \u2192 ${safeText(version)} from ${name}.
@@ -8100,7 +11446,7 @@ var update = command({
 var UPDATE_COMMANDS = [update];
 
 // src/commands/index.ts
-var COMMANDS = [
+var COMMANDS2 = [
   ...AUTH_COMMANDS,
   ...STATUS_COMMANDS,
   ...TERMINAL_COMMANDS,
@@ -8111,6 +11457,7 @@ var COMMANDS = [
   ...APPS_COMMANDS,
   ...AGENT_COMMANDS,
   ...HERDR_COMMANDS,
+  ...NODE_COMMANDS,
   ...UPDATE_COMMANDS
 ];
 function optionLine(o) {
@@ -8118,8 +11465,8 @@ function optionLine(o) {
   return `  ${flag.padEnd(26)} ${o.description}`;
 }
 function mainHelp() {
-  const width2 = Math.max(...COMMANDS.filter((c) => !c.hidden).map((c) => c.path.join(" ").length));
-  const lines = COMMANDS.filter((c) => !c.hidden).map((c) => `  ${c.path.join(" ").padEnd(width2)}  ${c.summary}`);
+  const width2 = Math.max(...COMMANDS2.filter((c) => !c.hidden).map((c) => c.path.join(" ").length));
+  const lines = COMMANDS2.filter((c) => !c.hidden).map((c) => `  ${c.path.join(" ").padEnd(width2)}  ${c.summary}`);
   return [
     `agentbox ${VERSION} \u2014 your agentbox, from this machine`,
     "",
@@ -8152,7 +11499,7 @@ function commandHelp(c) {
   ].join("\n");
 }
 function groupHelp(prefix) {
-  const members = COMMANDS.filter((c) => !c.hidden && prefix.every((w, i) => c.path[i] === w) && c.path.length > prefix.length);
+  const members = COMMANDS2.filter((c) => !c.hidden && prefix.every((w, i) => c.path[i] === w) && c.path.length > prefix.length);
   if (members.length === 0) return null;
   const width2 = Math.max(...members.map((c) => c.path.join(" ").length));
   return [
@@ -8166,7 +11513,7 @@ function groupHelp(prefix) {
 }
 
 // src/context.ts
-import os9 from "node:os";
+import os15 from "node:os";
 var VERSION_CHECK_MS = 24 * 60 * 6e4;
 var Context = class {
   constructor(io, env, config, globals, platform = process.platform, now = Date.now) {
@@ -8224,7 +11571,7 @@ var Context = class {
   }
   /** Where temporary files go: `$TMPDIR` (or Windows' `%TEMP%`), else the system's. */
   tempRoot() {
-    return this.env.TMPDIR || this.env.TEMP || this.env.TMP || os9.tmpdir();
+    return this.env.TMPDIR || this.env.TEMP || this.env.TMP || os15.tmpdir();
   }
   printJson(value) {
     this.out(`${JSON.stringify(value, null, 2)}
@@ -8307,7 +11654,7 @@ function describeLocalError(err) {
   return { message: e.path ? `${e.path}: ${what}` : `${what} (${e.syscall ?? e.code})`, code: e.code === "ENOENT" ? EXIT.NOT_FOUND : EXIT.FAILURE };
 }
 var INTERRUPT_GRACE_MS = 1500;
-async function run(argv, deps = {}) {
+async function run3(argv, deps = {}) {
   const io = deps.io ?? defaultIo();
   const env = deps.env ?? process.env;
   const fail = (message, code2) => {
@@ -8317,7 +11664,7 @@ async function run(argv, deps = {}) {
   };
   let parsed;
   try {
-    parsed = parseArgs(argv, COMMANDS);
+    parsed = parseArgs(argv, COMMANDS2);
   } catch (err) {
     if (err instanceof UsageError) return fail(err.message, EXIT.USAGE);
     throw err;
@@ -8381,6 +11728,6 @@ if (nodeMajor() < MIN_NODE_MAJOR) {
 `);
   process.exit(1);
 }
-var code = await run(process.argv.slice(2), { signals: true });
+var code = await run3(process.argv.slice(2), { signals: true });
 process.exitCode = code;
 process.stdout.write("", () => process.exit(code));